Conversation
Bumps [aquasecurity/setup-trivy](https://github.com/aquasecurity/setup-trivy) from 0.2.5 to 0.2.6. - [Release notes](https://github.com/aquasecurity/setup-trivy/releases) - [Commits](aquasecurity/setup-trivy@v0.2.5...v0.2.6) --- updated-dependencies: - dependency-name: aquasecurity/setup-trivy dependency-version: 0.2.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
update base.image.version post-6.10
…urity/setup-trivy-0.2.6 Bump aquasecurity/setup-trivy from 0.2.5 to 0.2.6
chore(ci): update Trivy engine to a newer, but safe version #12242
add a GitHub Workflow to add bugs to the project board
Jenkins tests are failing - but that's on account of the localstack issue; plus there's nothing in the PR that could affect the restassured tests. Fix signature of writeGuestbookAndStartFileDownload in xhtml
bump to 6.10.1
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Add bug to project | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/add-to-project@v1.0.2 | ||
| with: | ||
| project-url: https://github.com/orgs/IQSS/projects/34 | ||
| github-token: ${{ secrets.ADD_TO_PROJECT_PAT }} | ||
| labeled: "Type: Bug" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To fix the problem, add an explicit permissions block that restricts the default GITHUB_TOKEN to the minimal required scope. Since this workflow’s only step uses a custom PAT (secrets.ADD_TO_PROJECT_PAT) and does not rely on GITHUB_TOKEN, it is safe and preferable to set permissions: contents: read (or even permissions: {}) to minimize privileges. Using contents: read aligns with GitHub’s recommended minimal baseline and avoids surprises for tools expecting at least read access.
The best fix with minimal functional impact is to add a workflow‑level permissions block near the top of .github/workflows/add_bugs_to_project.yml, after the name: field and before on:. This will apply to all jobs in the workflow (there is only add-to-project), and the job definition itself does not need to change. No imports or additional methods are required, as this is purely a YAML configuration change.
Concretely:
- Edit
.github/workflows/add_bugs_to_project.yml. - Insert:
permissions:
contents: readbetween line 2 (the blank line after name) and line 3 (on:). This keeps existing behavior intact and satisfies the CodeQL requirement for explicit permissions.
| @@ -1,5 +1,8 @@ | ||
| name: Add bugs to project board | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| issues: | ||
| types: |
7 participants
No description provided.