Create generator-generic-ossf-slsa3-publish.yml#1
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| outputs: | ||
| digests: ${{ steps.hash.outputs.digests }} | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| # ======================================================== | ||
| # | ||
| # Step 1: Build your artifacts. | ||
| # | ||
| # ======================================================== | ||
| - name: Build artifacts | ||
| run: | | ||
| # These are some amazing artifacts. | ||
| echo "artifact1" > artifact1 | ||
| echo "artifact2" > artifact2 | ||
| # ======================================================== | ||
| # | ||
| # Step 2: Add a step to generate the provenance subjects | ||
| # as shown below. Update the sha256 sum arguments | ||
| # to include all binaries that you generate | ||
| # provenance for. | ||
| # | ||
| # ======================================================== | ||
| - name: Generate subject for provenance | ||
| id: hash | ||
| run: | | ||
| set -euo pipefail | ||
| # List the artifacts the provenance will refer to. | ||
| files=$(ls artifact*) | ||
| # Generate the subjects (base64 encoded). | ||
| echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" | ||
| provenance: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 6 months ago
To remediate this issue, add a permissions block to the build job, specifying the minimum privileges required for its steps. The build job only checks out code and builds artifacts without requiring any write access or interacting with pull requests, issues, or releases. The minimal required permission is contents: read, allowing the job to check out the repository's code.
To fix, insert a permissions: section in the build job (under line 21, before outputs:) as follows:
permissions:
contents: read
No new imports or definitions are required. Only the YAML block for the job needs updating.
| @@ -19,6 +19,8 @@ | ||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| outputs: | ||
| digests: ${{ steps.hash.outputs.digests }} | ||
|
|
1 participant
No description provided.