Skip to content

Conversation

@teplostanski
Copy link
Owner

No description provided.

Comment on lines +10 to +19
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
with:
node-version: 18
- name: Install dependencies
run: npm ci
- name: Run tests
run: npm run test

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 4 months ago

To fix the problem, add a permissions section to the workflow file (.github/workflows/unit-tests.yml). Place it at the root level, just beneath the workflow name, to apply it to all jobs in the workflow. Set contents: read as a minimal starting point, which is sufficient for checking out code and reading repository files but does not grant write access. No additional imports or code changes are required; just insert this YAML block in the correct location.

Suggested changeset 1
.github/workflows/unit-tests.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -1,4 +1,6 @@
 name: Unit Tests
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -1,4 +1,6 @@
name: Unit Tests
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
@teplostanski teplostanski deleted the test branch October 8, 2025 21:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants