update actions directory - #61
Conversation
GitHub Actions
Failure
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install MyCLI | ||
| uses: ./.github/actions/my-cli-action | ||
| with: | ||
| version: "1.2.3" | ||
|
|
||
| - name: Verify CLI Installation | ||
| run: | | ||
| echo "Checking MyCLI version..." | ||
| mycli --version |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 months ago
To fix the problem, add a permissions block to the workflow file .github/workflows/test-cli.yml. The block should be placed at the top level of the workflow (parallel to name and on) to restrict permissions for all jobs in the workflow. The recommended minimum for most workflows is contents: read, which allows jobs to read repository contents but not write or perform other privileged actions. This addresses the principle of least privilege, ensuring that the workflow cannot perform unnecessary actions with the GITHUB_TOKEN. No imports or method changes are necessary; just insert the YAML block as described.
| @@ -1,4 +1,6 @@ | ||
| name: Test MyCLI Setup | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: |
2 participants
Descripción
Por favor, incluye un resumen de los cambios y el propósito de la PR.
Tipo de cambio
¿Cómo se ha probado?
Describe los pasos que seguiste para probar los cambios.
Checklist