Skip to content

Potential fix for code scanning alert no. 1: Workflow does not contain permissions#78

Merged
poopoothegorilla merged 3 commits intomainfrom
alert-autofix-1
Jan 12, 2026
Merged

Potential fix for code scanning alert no. 1: Workflow does not contain permissions#78
poopoothegorilla merged 3 commits intomainfrom
alert-autofix-1

Conversation

@poopoothegorilla
Copy link
Collaborator

Potential fix for https://github.com/smartcontractkit/chainlink-framework/security/code-scanning/1

To fix the problem, add an explicit permissions: block to the workflow file. This should be added at the root of the workflow file (just after the name: or on: block), to ensure the default, minimal permissions apply to all jobs unless overridden. The safest minimal setting for nearly all workflows, unless they require special token access, is contents: read. If later steps genuinely require greater permissions, those can be granted at the job level as exceptions.

Steps:

  • Insert the following block after the name: line and before the on: block in .github/workflows/test.yml:
    permissions:
      contents: read
  • No imports or additional setup are needed, as this is pure YAML configuration.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

poopoothegorilla and others added 3 commits December 15, 2025 12:28
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@poopoothegorilla poopoothegorilla marked this pull request as ready for review December 15, 2025 17:31
@poopoothegorilla poopoothegorilla requested a review from a team as a code owner December 15, 2025 17:31
@poopoothegorilla poopoothegorilla enabled auto-merge (squash) December 15, 2025 17:32
@poopoothegorilla poopoothegorilla requested a review from a team December 16, 2025 16:06
@poopoothegorilla poopoothegorilla enabled auto-merge (squash) January 12, 2026 17:39
@poopoothegorilla poopoothegorilla merged commit e921420 into main Jan 12, 2026
22 checks passed
@poopoothegorilla poopoothegorilla deleted the alert-autofix-1 branch January 12, 2026 18:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants