Main #34
Main #34
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout Code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up JDK 17 | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| java-version: '17' | ||
| distribution: 'temurin' | ||
| cache: gradle | ||
|
|
||
| - name: Grant execute permission for gradlew | ||
| run: chmod +x gradlew | ||
|
|
||
| - name: Cache Gradle packages | ||
| uses: actions/cache@v3 | ||
| with: | ||
| path: | | ||
| ~/.gradle/caches | ||
| ~/.gradle/wrapper | ||
| key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-gradle- | ||
|
|
||
| - name: Build with Gradle | ||
| run: ./gradlew assembleDebug --stacktrace --no-daemon | ||
|
|
||
| - name: Upload APK | ||
| uses: actions/upload-artifact@v3 | ||
| if: success() | ||
| with: | ||
| name: blacky-apk | ||
| path: app/build/outputs/apk/debug/*.apk | ||
| retention-days: 30 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To fix the problem, explicitly define a permissions block so that the GITHUB_TOKEN used in this workflow has only the minimal required scope. For this workflow, the steps use actions/checkout (which needs read access to repository contents) and actions/upload-artifact (which does not require repo permissions). No write operations to the repo are present, so contents: read is sufficient.
The best way to fix this without changing functionality is to add a job-level permissions block under jobs.build, alongside runs-on. This scopes the permissions only to this job and avoids affecting any other jobs that might exist in this workflow file. Specifically, in .github/workflows/build.yml, add:
permissions:
contents: readdirectly under runs-on: ubuntu-latest (line 12), with correct indentation. No additional imports or methods are required, as this is purely a YAML configuration change.
| @@ -10,6 +10,8 @@ | ||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
|
|
||
| steps: | ||
| - name: Checkout Code |
1 participant
No description provided.