Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| uses: QuickBirdEng/workflows/.github/workflows/soup-approval-verification-workflow.yml@main | ||
| secrets: inherit |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the problem, add a permissions block specifying the least privilege needed. For workflows that only need to read repository contents, use contents: read (or further restrict as per actual requirements). The permissions block can be added either at the workflow root (before or after on:), which applies to all jobs, or to the specific job if jobs may need differing permissions. Since this workflow only defines one job (soups), and uses a reusable workflow, adding permissions at the root is the cleanest minimal fix. Edit .github/workflows/soup-approval-verification.yml to insert a permissions: block (e.g., contents: read) above the jobs: section.
| @@ -4,6 +4,9 @@ | ||
| pull_request_review: | ||
| types: [submitted] | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| soups: | ||
| uses: QuickBirdEng/workflows/.github/workflows/soup-approval-verification-workflow.yml@main |
1 participant
No description provided.