Skip to content

Conversation

@romainmenke
Copy link
Member

@romainmenke romainmenke commented Sep 14, 2024

Which issue, if any, is this issue related to?

See #39

Is there anything in the PR that needs further explanation?

Blocked on suitcss/stylelint-suitcss#16

Comment on lines +21 to +27
uses: ./.github/workflows/test-package.yml
name: latest
with:
package: stylelint-suitcss
stylelint-version: stylelint@latest
install-command: yarn
list-installed-versions-command: yarn list --pattern stylelint

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium test

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 3 months ago

To fix the problem, add a permissions block to the workflow file. This block should be placed at the root level (top-level, alongside name, on, etc.) to apply to all jobs in the workflow, unless a job overrides it. The minimal safe default is contents: read, which grants read-only access to repository contents. If the workflow or any called workflow requires additional permissions, those can be added as needed, but starting with contents: read is the recommended baseline. The change should be made at the top of .github/workflows/test-package-stylelint-suitcss-968.latest.yml, after the name field and before on:.


Suggested changeset 1
.github/workflows/test-package-stylelint-suitcss-968.latest.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/test-package-stylelint-suitcss-968.latest.yml b/.github/workflows/test-package-stylelint-suitcss-968.latest.yml
--- a/.github/workflows/test-package-stylelint-suitcss-968.latest.yml
+++ b/.github/workflows/test-package-stylelint-suitcss-968.latest.yml
@@ -1,2 +1,4 @@
 name: stylelint-suitcss
+permissions:
+  contents: read
 on:
EOF
@@ -1,2 +1,4 @@
name: stylelint-suitcss
permissions:
contents: read
on:
Copilot is powered by AI and may make mistakes. Always verify output.
Comment on lines +21 to +27
uses: ./.github/workflows/test-package.yml
name: next
with:
package: stylelint-suitcss
stylelint-version: stylelint/stylelint
install-command: yarn
list-installed-versions-command: yarn list --pattern stylelint

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium test

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 3 months ago

To fix the problem, add a permissions block to the workflow file to explicitly set the minimum required permissions for the GITHUB_TOKEN. Since the workflow only calls another workflow and does not appear to require any write permissions, the safest minimal starting point is to set permissions: read-all at the root of the workflow. This ensures that all jobs in the workflow, unless overridden, will only have read access. The change should be made at the top level of .github/workflows/test-package-stylelint-suitcss-968.next.yml, after the name and before the on block (or after the on block, but before jobs).


Suggested changeset 1
.github/workflows/test-package-stylelint-suitcss-968.next.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/test-package-stylelint-suitcss-968.next.yml b/.github/workflows/test-package-stylelint-suitcss-968.next.yml
--- a/.github/workflows/test-package-stylelint-suitcss-968.next.yml
+++ b/.github/workflows/test-package-stylelint-suitcss-968.next.yml
@@ -1,2 +1,3 @@
 name: stylelint-suitcss
+permissions: read-all
 on:
EOF
@@ -1,2 +1,3 @@
name: stylelint-suitcss
permissions: read-all
on:
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants