Repository navigation
Create python-package.yml - #31
Conversation
GitHub Actions
Failure
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| python-version: ["3.9", "3.10", "3.11"] | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up Python ${{ matrix.python-version }} | ||
| uses: actions/setup-python@v3 | ||
| with: | ||
| python-version: ${{ matrix.python-version }} | ||
| - name: Install dependencies | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| python -m pip install flake8 pytest | ||
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | ||
| - name: Lint with flake8 | ||
| run: | | ||
| # stop the build if there are Python syntax errors or undefined names | ||
| flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics | ||
| # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide | ||
| flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics | ||
| - name: Test with pytest | ||
| run: | | ||
| pytest |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 8 months ago
In general, the fix is to add an explicit permissions block that restricts the GITHUB_TOKEN to the least privileges needed. For a standard Python CI workflow that just checks out code, installs dependencies, and runs lint/tests, read-only access to repository contents is sufficient. This can be done either at the top level of the workflow (applying to all jobs) or inside the build job definition.
The best minimal fix without changing functionality is to add permissions: contents: read at the workflow root, between the on: block and the jobs: block. This ensures all jobs (currently just build) run with a read-only token for repository contents and no additional scopes. Concretely, in .github/workflows/python-package.yml, after line 11 (the last line of the on: block), insert:
permissions:
contents: readNo imports, methods, or additional definitions are required, as this is purely a YAML configuration change in the workflow file.
| @@ -9,6 +9,9 @@ | ||
| pull_request: | ||
| branches: [ "main" ] | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| build: | ||
|
|
This branch had an error being deployed
2 participants
No description provided.