Skip to content

Conversation

@poopoothegorilla
Copy link
Collaborator

Potential fix for https://github.com/smartcontractkit/chainlink-framework/security/code-scanning/1

To fix the problem, add an explicit permissions: block to the workflow file. This should be added at the root of the workflow file (just after the name: or on: block), to ensure the default, minimal permissions apply to all jobs unless overridden. The safest minimal setting for nearly all workflows, unless they require special token access, is contents: read. If later steps genuinely require greater permissions, those can be granted at the job level as exceptions.

Steps:

  • Insert the following block after the name: line and before the on: block in .github/workflows/test.yml:
    permissions:
      contents: read
  • No imports or additional setup are needed, as this is pure YAML configuration.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

poopoothegorilla and others added 3 commits December 15, 2025 12:28
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
…n permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@poopoothegorilla poopoothegorilla marked this pull request as ready for review December 15, 2025 17:31
@poopoothegorilla poopoothegorilla requested a review from a team as a code owner December 15, 2025 17:31
@poopoothegorilla poopoothegorilla enabled auto-merge (squash) December 15, 2025 17:32
@poopoothegorilla poopoothegorilla requested a review from a team December 16, 2025 16:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants