Skip to content

Conversation

@DarkStarStrix
Copy link
Owner

Potential fix for https://github.com/DarkStarStrix/PyC/security/code-scanning/2

To fix the problem, explicitly set the permissions key in the workflow file to restrict the GITHUB_TOKEN to the minimum required privileges. Since the shown workflow only checks out code and runs build/test commands (and does not appear to require write access to the repository or PRs), the minimal permission of contents: read is sufficient. This should be added at the top level of the workflow file (just after the name: line and before on:), so it applies to all jobs unless overridden.

Steps:

  • Edit .github/workflows/c-cpp.yml.
  • Add the following block after the name: C/C++ CI line:
    permissions:
      contents: read
  • No additional imports, methods, or definitions are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants