my-pull-java #39
my-pull-java #39
Conversation
Integrating with sonar qube
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v1 | ||
| - name: Set up JDK 1.8 | ||
| uses: actions/setup-java@v1 | ||
| with: | ||
| java-version: 1.8 | ||
| - name: Build with Maven | ||
| run: mvn -B package --file pom.xml | ||
|
|
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
To fix the problem, we should explicitly set the permissions key in the workflow to restrict the GITHUB_TOKEN to the least privilege necessary. For a typical CI build workflow like this, read-only access to repository contents (contents: read) is sufficient, as the workflow only checks out code and builds it, without making any changes to the repository or interacting with pull requests, issues, or releases. The best place to add this is at the workflow root (top-level), so it applies to all jobs unless overridden.
Edit .github/workflows/maven.yml and add a permissions: block with contents: read at the top level, just after the name: and before on:.
| @@ -1,3 +1,5 @@ | ||
| permissions: | ||
| contents: read | ||
| name: Java CI | ||
|
|
||
| on: [push] |
this is to see jenkins file example