clippy: integrated clippy using rules_lint#74
Merged
Conversation
added new workflow, integrated clippy using rules_lint Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>
dcalavrezo-qorix
requested review from
PandaeDo,
qor-lb and
vinodreddy-g
as code owners
dcalavrezo-qorix
had a problem deploying
to
workflow-approval
GitHub Actions
Failure
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+25
to
+28
| uses: eclipse-score/cicd-workflows/.github/workflows/static-analysis.yml@main | ||
| with: | ||
| bazel-targets: "//src/..." | ||
| bazel-config: "lint" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 13 days ago
To fix the problem, the workflow must declare an explicit permissions block, either at the workflow root (recommended here) or on the bazel-clippy job. Since this workflow only triggers static analysis through a reusable workflow and does not appear to need any write operations, we can set the GITHUB_TOKEN to read-only for repository contents. A minimal safe baseline is permissions: contents: read, which aligns with GitHub’s recommended least-privilege configuration for read-only workflows.
The best fix without changing functionality is to add a top-level permissions block right after the on: section (or directly after name:), applying to all jobs that do not override it. This will limit GITHUB_TOKEN to read-only on repository contents while still allowing the reusable workflow to run its analysis. No additional imports or methods are needed; only the YAML in .github/workflows/clippy.yml is changed.
Concretely: in .github/workflows/clippy.yml, insert a new top-level block:
permissions:
contents: readbetween the on: section (lines 15–22) and the jobs: section (line 24). This is sufficient to address the CodeQL finding.
Suggested changeset
1
.github/workflows/clippy.yml
| @@ -21,6 +21,9 @@ | ||
| merge_group: | ||
| types: [checks_requested] | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| bazel-clippy: | ||
| uses: eclipse-score/cicd-workflows/.github/workflows/static-analysis.yml@main |
Copilot is powered by AI and may make mistakes. Always verify output.
License Check Results🚀 The license check job ran with the Bazel command: bazel run //:license-checkStatus: Click to expand output |
|
The created documentation from the pull request is available at: docu-html |
fixed cr issue Signed-off-by: Dan Calavrezo <195309321+dcalavrezo-qorix@users.noreply.github.com>
dcalavrezo-qorix
temporarily deployed
to
workflow-approval
GitHub Actions
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
added new workflow, integrated clippy using rules_lint
Notes for Reviewer
Pre-Review Checklist for the PR Author
Checklist for the PR Reviewer
Post-review Checklist for the PR Author
References
Closes #