ci: add build workflow for monorepo #2
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout repo | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 20 | ||
| cache: 'npm' | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
|
||
| - name: Show TS config for validatabl | ||
| run: npx tsc --showConfig -p packages/validatabl | ||
|
|
||
| - name: Trace module resolution for validatabl | ||
| run: npx tsc -p packages/validatabl --traceResolution | ||
|
|
||
| - name: Build TypeScript monorepo | ||
| run: npm run build |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 days ago
To fix the problem, add a permissions block to the workflow, either at the root (applies to all jobs) or to the individual job. Since there is only one job (build), the minimal effective change is to add permissions: contents: read at the workflow root (after the name: or on: block), which limits the GITHUB_TOKEN permissions to only read contents. This is the least privilege required for standard build/check workflows, unless a job actually needs write access to contents, issues, or PRs (which is not apparent here). The change consists of adding the block:
permissions:
contents: readafter the name: and before on: or after on:.
| @@ -1,4 +1,6 @@ | ||
| name: Build | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: |
No description provided.