release: Merge latest prod-staging changes to prod-stable#4
release: Merge latest prod-staging changes to prod-stable#4unikraft-bot wants to merge 13 commits intoprod-stablefrom
Conversation
Signed-off-by: Alexander Jung <alex@unikraft.com>
Running `make generate` will perform the generation. Signed-off-by: Alexander Jung <alex@unikraft.com>
Signed-off-by: Alexander Jung <alex@unikraft.com>
Signed-off-by: Alexander Jung <alex@unikraft.com>
Signed-off-by: Alexander Jung <alex@unikraft.com>
…es.get_type_string() Signed-off-by: Alex-Andrei Cioc <andrei.cioc@unikraft.io>
…es.get_type_string() (#1) Reviewed-by: Alexander Jung <alex@unikraft.com> Approved-by: Alexander Jung <alex@unikraft.com>
This commit adds the conventional workflows used in our auto-generated SDKs: - actionlint - check-pr - release-stable - sync Signed-off-by: Alex-Andrei Cioc <andrei.cioc@unikraft.io>
Reviewed-by: Alexander Jung <alex@unikraft.com> Approved-by: Alexander Jung <alex@unikraft.com>
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Install action linter | ||
| run: | | ||
| mkdir -p "$HOME"/.local/bin | ||
| curl -sL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash | bash -s -- latest "$HOME"/.local/bin | ||
|
|
||
| - name: Check that all workflows are valid | ||
| run: actionlint -verbose |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 4 months ago
The best way to fix this problem is to add an explicit permissions block that restricts the privileges granted to the GITHUB_TOKEN used within this workflow. Since the workflow only runs actionlint (a linter) on workflows and does not require write access to contents, issues, or pull requests, we should add permissions: contents: read at the job level (actionlint under jobs). This gives minimal necessary access, helping to enforce POLP.
To implement, add the following keys under the actionlint job (e.g., just above runs-on:). No new methods, definitions, or imports are needed; just YAML key insertion. There is no indication in the shown snippet that any additional permissions are required, so only contents: read should be specified.
| @@ -13,6 +13,8 @@ | ||
|
|
||
| jobs: | ||
| actionlint: | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
Signed-off-by: Alex-Andrei Cioc <andrei.cioc@unikraft.io>
Reviewed-by: Alexander Jung <alex@unikraft.com> Approved-by: Alexander Jung <alex@unikraft.com>
Signed-off-by: Alex-Andrei Cioc <andrei.cioc@unikraft.io>
Reviewed-by: Alexander Jung <alex@unikraft.com> Approved-by: Alexander Jung <alex@unikraft.com>
3 participants
Automated changes by create-pull-request GitHub action