chore: Add explicit permissions to PR linting workflow #128
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/cloudscape-design/chart-components/security/code-scanning/1
General Fix:
To address this, add a
permissionsblock specifying only the least privileges required at either the workflow level (root, for all jobs) or, if some jobs need different permissions, inside the job(s) themselves. Since the only job in this file delegates to an external composite workflow, and without knowledge of any elevated permissions being required, the safest minimal starting point is to setpermissions: read-allat the root of the workflow file (which gives all scopes read access only).Detailed Fix:
Insert a
permissions:block after the workflow'sname:field and beforeon:, at the root level, with a value ofread-all. This ensures that the workflow (and any called reusable workflow) receives only read-only access tokens by default, reducing the risk of unwanted repo modification. This is compliant with recommendations and does not otherwise affect workflow behavior.Changes needed:
.github/workflows/lint-pr.ymlSuggested fixes powered by Copilot Autofix. Review carefully before merging.