Skip to content

Potential fix for code scanning alert Workflow does not contain permissions#530

Merged
AlexJSully merged 2 commits intomainfrom
alexjsully-250822-yaml-permissions
Aug 23, 2025
Merged

Potential fix for code scanning alert Workflow does not contain permissions#530
AlexJSully merged 2 commits intomainfrom
alexjsully-250822-yaml-permissions

Conversation

@AlexJSully
Copy link
Owner

Fix for "Workflow does not contain permissions" by adding permissions: contents: read.

@AlexJSully AlexJSully requested a review from Copilot August 23, 2025 01:58
@AlexJSully AlexJSully self-assigned this Aug 23, 2025
@vercel
Copy link

vercel bot commented Aug 23, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
portfolio Ready Ready Preview Comment Aug 23, 2025 2:02am

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR addresses a GitHub code scanning security alert by adding explicit permissions declarations to GitHub Actions workflows. The change implements the principle of least privilege by restricting workflow permissions to only read access to repository contents.

  • Adds permissions: contents: read to two workflow files
  • Addresses security best practice for GitHub Actions workflows

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
.github/workflows/markdown-lint.yaml Adds explicit read-only permissions for contents
.github/workflows/code-qa.yaml Adds explicit read-only permissions for contents

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@AlexJSully AlexJSully merged commit 3d22d11 into main Aug 23, 2025
8 checks passed
@AlexJSully AlexJSully deleted the alexjsully-250822-yaml-permissions branch August 23, 2025 02:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants