VPLAY-11240: Add Coverity Test build workflow for AAMP#538
VPLAY-11240: Add Coverity Test build workflow for AAMP#538Vinish100 wants to merge 1 commit intodev_sprint_25_2from
Conversation
Reason for change: Add a workflow to build AAMP in Linux environment with the same docker image used for coverity scans. Test Procedure: Ensure the workflow is running as expected Risks: Low Priority: P1 Signed-off-by: Vinish100 <vinish.balan@gmail.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Build AAMP in Linux environment | ||
| runs-on: ubuntu-latest | ||
| # The docker image is used for coverity scans as well. | ||
| container: | ||
| image: ghcr.io/rdkcentral/docker-rdk-ci:latest | ||
|
|
||
| steps: | ||
| # Checkout the aamp repository | ||
| - name: Checkout aamp code | ||
| uses: actions/checkout@v3 | ||
|
|
||
| # Install AAMP | ||
| # Option D builds dependencies only. | ||
| # Option A builds AAMP only (assuming dependencies are already installed). | ||
| # Option K skips Kotlin build. | ||
| # 'yes' is used to auto-confirm any prompts during installation | ||
| - name: Install AAMP | ||
| run: | | ||
| chmod +x ./install-aamp.sh | ||
| yes | ./install-aamp.sh -D | ||
| yes | ./install-aamp.sh -Ak |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To fix the problem, add an explicit permissions block, ideally at the workflow root for broad effect, but it can also be added at the job level if specific jobs have different requirements. In this workflow, neither the root nor job has permissions, so the best practice is to add at least contents: read globally, unless more granular write permissions are needed for particular tasks (which does not appear to be the case here).
Edit .github/workflows/Linux-build.yml and insert the following after the name: line and before on::
permissions:
contents: readThis ensures that the GITHUB_TOKEN issued to steps in the workflow has only read-access to repository contents, reducing risk from default write privileges. No other lines or blocks need changes.
| @@ -1,4 +1,6 @@ | ||
| name: Build AAMP in Linux Environment | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| pull_request: |
1 participant
Reason for change: Add a workflow to build AAMP in Linux environment with the same docker image used for coverity scans. Test Procedure: Ensure the workflow is running as expected
Risks: Low
Priority: P1