Potential fix for code scanning alert no. 4: Workflow does not contain permissions#350
Open
ThomasPedleyNHS wants to merge 3 commits into
Open
Potential fix for code scanning alert no. 4: Workflow does not contain permissions#350ThomasPedleyNHS wants to merge 3 commits into
ThomasPedleyNHS wants to merge 3 commits into
Conversation
… not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
… not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
|
There was a problem hiding this comment.
Pull request overview
Adds explicit GitHub Actions permissions declarations to address code-scanning alert #4 (“Workflow does not contain permissions”) by defining the GITHUB_TOKEN scopes required by workflows that read repo content and create releases / comment on PRs.
Changes:
- Add workflow-level
permissions: contents: writeto the CI workflow so release creation can succeed. - Add workflow-level permissions to the PR lint workflow for reading contents and writing to PRs.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/pr-lint.yaml | Adds explicit permissions for PR linting workflow. |
| .github/workflows/continuous-integration.yml | Adds explicit permissions for CI workflow, including repo write for release creation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+4
to
+5
| permissions: | ||
| contents: write |
| name: PR Quality Check | ||
| on: pull_request | ||
| permissions: | ||
| contents: read |
Comment on lines
+3
to
+5
| permissions: | ||
| contents: read | ||
| pull-requests: write |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/NHSDigital/nhs-app-api/security/code-scanning/4
In general, the fix is to explicitly declare a
permissionsblock, either at the top (workflow level, undername/on) or inside the specific job. This block should grant the least privileges required. For this workflow, most steps need only read access to the repository contents, while the release-creation step requires write access to repository contents.The single best fix with minimal functional change is to add a workflow-level
permissionsblock after theon: pushline that setscontents: write. This is already the effective requirement becauseactions/create-release@v1needs to create releases/tags, which map tocontents: write. We do not see any need for other scopes (issues, pull-requests, packages, etc.), so they should remain unset (implicitlynone). No other code changes are needed.Concretely, in
.github/workflows/continuous-integration.yml, insert:after line 3 (
on: push). No imports or additional methods are required, as this is purely a YAML configuration change.Suggested fixes powered by Copilot Autofix. Review carefully before merging.