Skip to content

Workflow does not contain permissions #798

@elopezanaya

Description

@elopezanaya

Problem
Code scan complains about missing permissions for github workflow actions

issue 1 : https://github.com/microsoft/omnichannel-chat-widget/security/code-scanning/19
component :.github/workflows/chat-widget-release-manual.yml:8

iissue 2 : https://github.com/microsoft/omnichannel-chat-widget/security/code-scanning/18
component : .github/workflows/chat-components-pr.yml:13

issue 3 : https://github.com/microsoft/omnichannel-chat-widget/security/code-scanning/17
compoonent :.github/workflows/chat-components-release.yml:12

issue 4 : https://github.com/microsoft/omnichannel-chat-widget/security/code-scanning/16
componentn : .github/workflows/chat-components-release-manual.yml:8

issue 5: https://github.com/microsoft/omnichannel-chat-widget/security/code-scanning/13
componentn : .github/workflows/sync-issue-to-ado-work-item.yml:12

issue 6: https://github.com/microsoft/omnichannel-chat-widget/security/code-scanning/12
component :
.github/workflows/chat-widget-release-manual.yml:63

issue 7: https://github.com/microsoft/omnichannel-chat-widget/security/code-scanning/8
component : .github/workflows/chat-components-release.yml:67

issue 8 :
https://github.com/microsoft/omnichannel-chat-widget/security/code-scanning/7
.github/workflows/chat-components-release-manual.yml:63

Error
If a GitHub Actions job or workflow has no explicit permissions set, then the repository permissions are used. Repositories created under organizations inherit the organization permissions. The organizations or repositories created before February 2023 have the default permissions set to read-write. Often these permissions do not adhere to the principle of least privilege and can be reduced to read-only, leaving the write permission only to a specific types as issues: write or pull-requests: write.

Expected
Add changes that meet the criteria, without messing wiith functionality, release.yaml should be able to publish and PR jobs should be to download and write to support storybooks

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions