bring over offline changes #1
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Build and analyze | ||
| runs-on: windows-latest | ||
|
|
||
| steps: | ||
| - name: Set up JDK | ||
| uses: actions/setup-java@v4.4.0 | ||
| with: | ||
| java-version: 17 | ||
| distribution: 'zulu' | ||
|
|
||
| runs-on: ubuntu-latest | ||
| - name: Checkout | ||
| uses: actions/checkout@v4.2.1 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: 9.0.x | ||
|
|
||
| - name: Delete nuget*.config files | ||
| run: rm -f nuget*.config | ||
|
|
||
| - name: Restore dependencies | ||
| run: dotnet restore | ||
|
|
||
| - name: Build | ||
| run: dotnet build --no-restore | ||
|
|
||
| - name: Test | ||
| run: dotnet test --no-build --verbosity normal | ||
| - name: 🛠 Cache SonarQube Cloud packages | ||
| uses: actions/cache@v4.2.3 | ||
| with: | ||
| path: ~\sonar\cache | ||
| key: ${{ runner.os }}-sonar | ||
| restore-keys: ${{ runner.os }}-sonar | ||
|
|
||
| - name: 🛠 Cache SonarQube Cloud scanner | ||
| id: cache-sonar-scanner | ||
| uses: actions/cache@v4.2.3 | ||
| with: | ||
| path: .\.sonar\scanner | ||
| key: ${{ runner.os }}-sonar-scanner | ||
| restore-keys: ${{ runner.os }}-sonar-scanner | ||
|
|
||
| - name: 🛠 Install SonarQube Cloud scanner | ||
| if: steps.cache-sonar-scanner.outputs.cache-hit != 'true' | ||
| shell: powershell | ||
| run: | | ||
| New-Item -Path .\.sonar\scanner -ItemType Directory | ||
| dotnet tool update dotnet-sonarscanner --tool-path .\.sonar\scanner | ||
| - name: 🔍 Restore, 🛠 Build and 🧪 Test with ☁️ SonarCloud / Qube project - ${{ vars.SONAR_PROJECT_NAME }} | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | ||
| shell: powershell | ||
| run: | | ||
| dotnet tool install --global dotnet-coverage | ||
| .\.sonar\scanner\dotnet-sonarscanner begin /k:"astar-development_${{ github.event.repository.name }}" /o:"astar-development" /d:sonar.token="${{ secrets.SONAR_TOKEN }}" /d:sonar.host.url="https://sonarcloud.io" /d:sonar.cs.vscoveragexml.reportsPaths=coverage.xml /d:sonar.scanner.scanAll=false /d:sonar.scanner.skipJreProvisioning=true | ||
| dotnet build --configuration Release | ||
| dotnet-coverage collect 'dotnet test --filter "FullyQualifiedName!~Tests.EndToEnd"' -f xml -o 'coverage.xml' | ||
| .\.sonar\scanner\dotnet-sonarscanner end /d:sonar.token="${{ secrets.SONAR_TOKEN }}" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
To fix the problem, we should explicitly declare a permissions block at the appropriate scope in the workflow YAML file. Since only the default GITHUB_TOKEN is used and none of the steps require write permissions to repository contents, we can restrict the permissions to read-only for contents. This can be set at the workflow level (at the root, above jobs:) to apply to all jobs, or at the job level if different jobs require different permissions.
For this workflow in .github/workflows/dotnet.yml, the single best way to fix the problem is to add the following block after the name: section and before jobs::
permissions:
contents: readNo additional imports or definitions are required; just this addition to the YAML structure.
| @@ -7,6 +7,9 @@ | ||
| pull_request: | ||
| branches: [ "main" ] | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| build: | ||
| name: Build and analyze |
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
No description provided.