Update workflow that handles contributor comments to the latest version#5190
Update workflow that handles contributor comments to the latest version#5190
Conversation
|
@rtibbles All secrets are already available in this repo, so no set up needed. |
| uses: learningequality/.github/.github/workflows/contributor-issue-comment.yml@main | ||
| secrets: | ||
| LE_BOT_APP_ID: ${{ secrets.LE_BOT_APP_ID }} | ||
| LE_BOT_PRIVATE_KEY: ${{ secrets.LE_BOT_PRIVATE_KEY }} | ||
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} | ||
| SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL: ${{ secrets.SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
To fix this problem, you should add a permissions: key to the workflow file. This can be done at the top level (applies to all jobs), or specifically for the call-workflow job. Since this workflow only calls another workflow and does not require any write permissions itself, the safest minimal permissions are permissions: {} (no permissions), or at most permissions: contents: read if the called workflow requires it. If you know specifically what permissions are needed by the reusable workflow, you can set them accordingly. For a minimal, least-privilege fix, insert the following at the top level, after the name: declaration and before on::
permissions:
contents: readIf you know more specific permission requirements, you can adjust, but contents: read is generally sufficient for most workflows that do not modify code or use write APIs.
| @@ -1,3 +1,5 @@ | ||
| permissions: | ||
| contents: read | ||
| name: Handle contributor comment on GitHub issue | ||
|
|
||
| on: |
Summary
Companion to learningequality/.github#29 which was tested in
test-actionssuccessfully. Also renames the file to match exactly the new example calling script in.githubrepository.