Skip to content

Potential fix for code scanning alert no. 2: Workflow does not contain permissions#135

Merged
glenn-jocher merged 1 commit intomainfrom
alert-autofix-2
May 15, 2025
Merged

Potential fix for code scanning alert no. 2: Workflow does not contain permissions#135
glenn-jocher merged 1 commit intomainfrom
alert-autofix-2

Conversation

@glenn-jocher
Copy link
Member

@glenn-jocher glenn-jocher commented May 15, 2025

Potential fix for https://github.com/ultralytics/mkdocs/security/code-scanning/2

To fix the issue, we need to add a permissions block to the notify job. Since the job only performs notification tasks and does not interact with the repository in a way that requires write permissions, we can set the permissions to contents: read. This ensures that the job has the minimal permissions required to execute its tasks securely.

The permissions block should be added under the notify job definition, specifically after the runs-on key.


Suggested fixes powered by Copilot Autofix. Review carefully before merging.

🛠️ PR Summary

Made with ❤️ by Ultralytics Actions

🌟 Summary

Minor update to the GitHub Actions workflow to improve security permissions during publishing. 🔒🚀

📊 Key Changes

  • Added explicit contents: read permissions to the publish workflow job in .github/workflows/publish.yml.

🎯 Purpose & Impact

  • Enhances security by limiting workflow permissions to only what's necessary.
  • Reduces potential risks by following GitHub best practices for Actions.
  • No impact on user-facing features or documentation; this is a behind-the-scenes improvement.

…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Glenn Jocher <glenn.jocher@ultralytics.com>
@UltralyticsAssistant UltralyticsAssistant added devops GitHub Devops or MLops documentation Improvements or additions to documentation labels May 15, 2025
@UltralyticsAssistant
Copy link
Member

👋 Hello @glenn-jocher, thank you for submitting this ultralytics/mkdocs 🚀 pull request! This is an automated response to help ensure a smooth review process:

  • Define a Purpose: Please confirm your PR description clearly explains the intent of your fix, and link to any relevant issues. Make sure your commit messages are clear and follow project conventions.
  • Synchronize with Source: Ensure your branch is up-to-date with ultralytics/mkdocs main. If it’s not, please update by clicking ‘Update branch’ or running git pull and git merge main locally.
  • Ensure CI Checks Pass: Double-check that all Ultralytics Continuous Integration (CI) checks are passing. Address any failures if present.
  • Update Documentation: If your change impacts documentation, please update the docs accordingly.
  • Add Tests: Where applicable, add or update tests to cover your changes and make sure all tests pass.
  • Sign the CLA: If this is your first Ultralytics PR, please sign our Contributor License Agreement (CLA) by commenting “I have read the CLA Document and I sign the CLA.”
  • Minimize Changes: Limit your changes to the minimum required for this fix or feature. "It is not daily increase but daily decrease, hack away the unessential. The closer to the source, the less wastage there is." — Bruce Lee

For additional guidance, please review our Contributing Guide. An Ultralytics engineer will review your PR and assist you soon. If you have questions, feel free to leave a comment. Thank you for helping us keep our workflows secure and efficient! 🔒✨

@glenn-jocher glenn-jocher marked this pull request as ready for review May 15, 2025 19:14
@glenn-jocher glenn-jocher merged commit 98362fd into main May 15, 2025
4 checks passed
@glenn-jocher glenn-jocher deleted the alert-autofix-2 branch May 15, 2025 19:15
@UltralyticsAssistant
Copy link
Member

🎉 Fantastic work, @glenn-jocher! This merge is a great example of thoughtful stewardship behind the scenes—“The measure of who we are is what we do with what we have.” (Vince Lombardi) Your focus on security and best practices strengthens our foundation and empowers the entire Ultralytics community. Thank you for your consistent dedication to excellence! 🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

devops GitHub Devops or MLops documentation Improvements or additions to documentation

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants