From b92209be015bdb41113906cf878ea1511f91e582 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kov=C3=A1cs=20B=C3=A1lint=20Hunor?= Date: Mon, 13 Jul 2026 10:58:48 +0300 Subject: [PATCH] Potential fix for code scanning alert no. 2: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- .github/workflows/devsecops-pipeline.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/devsecops-pipeline.yml b/.github/workflows/devsecops-pipeline.yml index f311f2b..98c62fb 100644 --- a/.github/workflows/devsecops-pipeline.yml +++ b/.github/workflows/devsecops-pipeline.yml @@ -19,6 +19,8 @@ env: jobs: # Run the full unit test suite before any security or signing steps. test: + permissions: + contents: read runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 @@ -61,6 +63,8 @@ jobs: # Phase 1 + 2: Run security checks, sign each result, build chain security-checks: + permissions: + contents: read needs: test runs-on: ubuntu-latest if: "github.actor != 'dependabot[bot]' && github.actor != 'renovate[bot]'"