Conversation
automatically builds the docs and deploys the default branch
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
Adds a static website landing page and a GitHub Actions job intended to generate Rust docs and deploy them to GitHub Pages.
Changes:
- Added
website/index.htmlas a documentation landing page. - Added a
docsjob to.github/workflows/ci.ymlto build Rust docs and deploy thewebsite/directory to GitHub Pages.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
website/index.html |
New static homepage with links to source and documentation. |
.github/workflows/ci.yml |
Adds a docs build + GitHub Pages deployment job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
LCOV of commit
|
| name: Build the documentation | ||
| runs-on: ubuntu-latest | ||
| needs: [container] | ||
| container: | ||
| image: ${{ needs.container.outputs.container_name }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| submodules: recursive | ||
|
|
||
| - name: Set stm32l4r5zi config | ||
| run: just config load stm32l4r5zi_def --no-confirm | ||
|
|
||
| - name: Generate docs | ||
| run: cargo doc --no-deps --workspace | ||
|
|
||
| - name: Upload docs artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: docs | ||
| path: target/doc | ||
|
|
||
| deploy-docs: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 days ago
In general, to fix this class of issue, you add an explicit permissions block either at the workflow root (applies to all jobs without their own permissions) or at the individual job level, and scope it down to exactly what that job needs. For read-only workflows that just check out code and run tests/builds, contents: read is typically sufficient.
For this specific workflow snippet, the flagged build-docs job only checks out code, runs cargo doc, and uploads artifacts. None of these actions require write access to repository contents; they only require read access to pull the code. The safest minimal fix, without changing existing functionality, is to add a permissions block with contents: read to the build-docs job. The deploy-docs job already has an explicit permissions block, so it does not need changes. Other jobs (e.g., fmt, kani, build-stm32-l4r5zi-def, and presumably test/container) might also warrant explicit permissions in a broader hardening pass, but CodeQL’s reported issue is for build-docs, so we will scope the change there.
Concretely, in .github/workflows/ci.yml, under the build-docs: job (after runs-on / needs or before container), add:
permissions:
contents: readNo imports or other definitions are needed, since this is pure workflow YAML.
| @@ -138,6 +138,8 @@ | ||
| name: Build the documentation | ||
| runs-on: ubuntu-latest | ||
| needs: [container] | ||
| permissions: | ||
| contents: read | ||
| container: | ||
| image: ${{ needs.container.outputs.container_name }} | ||
| steps: |
No description provided.