Mercurial > p > roundup > code
changeset 7129:c7e35b96907d
Try another permission setup.
security events has to be write to allow codeql to work. OSSF-security
scan complains with the write at the top level.
So leave top level read only and add write at job level.
See if codeql will not fail (missing write perms caused failure in
codeql init).
Note that ossf recommended remediation step using:
https://app.stepsecurity.io/secureworkflow/roundup-tracker/roundup/codeql-analysis.yml/master?enable=permissions
had no issue with the permissions defined in the workflow. I had a
green checkmark.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Mon, 23 Jan 2023 21:21:38 -0500 |
| parents | 2685dd56806a |
| children | 890b55c374a3 |
| files | .github/workflows/codeql-analysis.yml |
| diffstat | 1 files changed, 7 insertions(+), 4 deletions(-) [+] |
line wrap: on
line diff
--- a/.github/workflows/codeql-analysis.yml Mon Jan 23 21:11:39 2023 -0500 +++ b/.github/workflows/codeql-analysis.yml Mon Jan 23 21:21:38 2023 -0500 @@ -21,19 +21,22 @@ schedule: - cron: '28 17 * * 1' +permissions: + contents: read + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true -permissions: - contents: read - security-events: write - jobs: analyze: name: Analyze runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + strategy: fail-fast: false matrix: