🚚 transfer release/v1.7.2.2 into main.

[ljy65535]

No description provided.

To fix the issue, you should explicitly set the permissions key either at the top/root of the workflow or for each job (if jobs require differing permissions). In this case, the safest and simplest fix is to set the root-level permissions: block, since all jobs simply check out code (requiring only contents: read) and do not interact with issues or pull requests. This change should be made at the top of the workflow file, after the name: and before the first key (concurrency:). No additional imports, methods, or code changes are necessary, just a YAML block specifying minimal permissions.

---

To fix the problem, add a permissions block to the workflow to explicitly restrict the GITHUB_TOKEN to the minimum required privileges. Since all jobs appear only to build Docker images and push them to DockerHub (using secrets for authentication), and do not interact with issues, PRs, or write to repo contents, the best practice is to set the overall workflow permissions to read-only or, most restrictively, to {} (which disables all default permissions for the workflow). This block should be placed near the top of the workflow file—immediately after name: and before concurrency:. No other changes are needed in the workflow as no job appears to require escalation from the minimum. This change confines the GITHUB_TOKEN to the minimum privileges, hardening CI security.

---

To fix this problem, explicitly set a permissions: key at the workflow root, just below the name: or on: sections. This ensures that all jobs in the workflow only receive the minimal required repository privileges. For this workflow, the only repository interaction needed is checking out code, which requires contents: read. Other steps interact solely with Docker registry using secrets, not the repository. Thus, add permissions:\n contents: read below the name: (or on: if present).

Specifically:

• Edit .github/workflows/docker-build-push-mainland.yml.
• Add the following lines after the name: (line 1) or after the on: block for clarity:

  permissions:
    contents: read

• This grants read-only access and ensures the GITHUB_TOKEN in all jobs cannot be used for write access or privileged operations in the repository.

No other areas of the YAML file or code need modification.

---

The best way to fix this problem is to explicitly add a permissions block at the root of the workflow (.github/workflows/docker-build-push-mainland.yml), so that all jobs will inherit the least privilege needed unless overridden locally. For workflows whose jobs do not interact with the repo (e.g., only using docker and external secrets), the recommended minimal permissions are typically contents: read, which allows jobs to clone the repo if needed but does not enable write operations. If a particular job really does need to write (for example, to create a release or interact with issues/pull requests), selectively grant those permissions only to that job. In this case, as all jobs appear to only be pushing docker images and do not interact with the repo or issues, the global workflow permission of contents: read is correct. Edit the top of .github/workflows/docker-build-push-mainland.yml to add:

permissions:
  contents: read

directly below the workflow name (and before on:).

To fix the problem and adhere to least privilege best practices, add a permissions key set to contents: read at the top (root) of the workflow file, right after the name (or on block) but before jobs. This ensures all jobs in this workflow only have read access to repository contents by default. If a specific job needs additional write privileges (for instance, for PR status updates), these can be added at the job level. This change does not affect the functionality of this workflow (which only checks out code and pushes to DockerHub using external credentials).

Implementation Steps:

• Edit .github/workflows/docker-build-push-overseas.yml
• Insert the block:

  permissions:
    contents: read

  right after the name (or immediately before or after the on block, per YAML semantics).

---

To address this problem, you should add an explicit permissions block to limit the permissions granted to the GITHUB_TOKEN for this workflow. Since the workflow only checks out repository code (which needs contents: read) and otherwise interacts with DockerHub via a secret, you can safely limit permissions to the minimum. The recommended approach is to specify the permissions block at the workflow root, so it applies to all jobs unless overridden, or you can set it individually for jobs if granular control is desired. The best practice is to use:

permissions:
  contents: read

unless some step or future edit truly requires additional scopes. You should place this block immediately after the name: key, before the on: key, at the top of .github/workflows/docker-build-push-overseas.yml.

---

To fix this problem, add a permissions key at the root of the workflow file .github/workflows/docker-build.yml, immediately following the workflow's name and before the on block. Assign contents: read as the minimal permission needed. This ensures GITHUB_TOKEN is restricted to only being able to read repository contents, thus reducing risk if a workflow step or dependency is compromised, while not affecting workflow functionality since none of the jobs require write access.