codeql/actions/ql/lib/ext/config/actions_permissions.yml at dae058250b8efd5101298283867d739eceb7c1ff · microsoft/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
extensions:
  - addsTo:
      pack: codeql/actions-all
      extensible: actionsPermissionsDataModel
    data:
      - ["actions/checkout", "contents: read"]
      - ["actions/setup-node", "contents: read"]
      - ["actions/setup-python", "contents: read"]
      - ["actions/setup-java", "contents: read"]
      - ["actions/setup-go", "contents: read"]
      - ["actions/setup-dotnet", "contents: read"]
      - ["actions/labeler", "contents: read"]
      - ["actions/labeler", "pull-requests: write"]
      - ["actions/attest", "id-token: write"]
      - ["actions/attest", "attestations: write"]
      # No permissions needed for actions/add-to-project
      - ["actions/dependency-review-action", "contents: read"]
      - ["actions/attest-sbom", "id-token: write"]
      - ["actions/attest-sbom", "attestations: write"]
      - ["actions/stale", "contents: write"]
      - ["actions/stale", "issues: write"]
      - ["actions/stale", "pull-requests: write"]
      - ["actions/attest-build-provenance", "id-token: write"]
      - ["actions/attest-build-provenance", "attestations: write"]
      - ["actions/deploy-pages", "pages: write"]
      - ["actions/deploy-pages", "id-token: write"]
      - ["actions/delete-package-versions", "packages: write"]
      - ["actions/jekyll-build-pages", "contents: read"]
      - ["actions/jekyll-build-pages", "pages: write"]
      - ["actions/jekyll-build-pages", "id-token: write"]
      - ["actions/publish-action", "contents: write"]
      - ["actions/versions-package-tools", "contents: read"]
      - ["actions/versions-package-tools", "actions: read"]
      - ["actions/reusable-workflows", "contents: read"]
      - ["actions/reusable-workflows", "actions: read"]
      - ["actions/ai-inference", "contents: read"]
      - ["actions/ai-inference", "models: read"]
      # TODO: Add permissions for actions/download-artifact
      # TODO: Add permissions for actions/upload-artifact
      # No permissions needed for actions/upload-pages-artifact
      # TODO: Add permissions for actions/cache
      # No permissions needed for actions/configure-pages