fix: audit workflow permissions across Actions files - #328
Conversation
Add least-privilege contents: read permission to all GitHub Actions workflows, fix malformed YAML syntax across CI configuration files, correct duplicate workflow name lines, and repair broken trigger declarations.
📝 WalkthroughWalkthroughWorkflow files add explicit read-only contents permissions, and many workflow headers add ChangesWorkflow hardening
Dependabot configuration
Repository metadata
Estimated code review effort: 3 (Moderate) | ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8).github/dependabot.ymlCheckov retry budget exhausted before isolating this batch .github/workflows/accessibility.ymlCheckov retry budget exhausted before isolating this batch .github/workflows/ci-cd.ymlCheckov retry budget exhausted before isolating this batch
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 8
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
tatus --short (1)
1-869: 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick winRemove accidentally committed Git output file.
This file contains Git line-ending conversion warnings and appears to have been created by a command-line typo (e.g.,
git status > "tatus --short"). Please delete it to keep the repository clean.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tatus` --short around lines 1 - 869, Delete the accidentally committed Git output file named “tatus --short” from the repository; it is not source code and should not be replaced or regenerated.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/dependabot.yml:
- Around line 7-21: Remove the GitHub Actions workflow keys from
.github/dependabot.yml, including permissions, both on entries, concurrency, and
jobs with its lint block; retain only valid Dependabot configuration entries.
In @.github/workflows/ci-js.yml:
- Around line 5-8: Update the workflow configuration by removing the empty
inputs entry from the workflow_call section and moving the contents read
permissions block to the workflow’s top level, outside workflow_call, so the
reusable workflow uses only supported workflow_call keys.
In @.github/workflows/ci-python.yml:
- Around line 1-2: Fix the top-level header in the CI workflow by separating the
workflow name from the permissions declaration into valid YAML, preserving the
intended `CI — Python` name and a single `contents: read` permissions block.
Remove the duplicate permissions block referenced by the comment.
In @.github/workflows/docker.yml:
- Around line 5-6: Remove the invalid duplicate “on: read” blocks from
.github/workflows/docker.yml (lines 5-6), docs-check.yml (5-6), docs-lint.yml
(5-6), evo-harness.yml (8-9), health.yml (5-6), quality-gate.yml (9-10), and
secret-redaction-guard.yml (9-10). In
.github/workflows/security-comprehensive.yml (5-8), remove both invalid blocks
while preserving each workflow’s existing valid event triggers.
In @.github/workflows/health-check.yml:
- Around line 5-6: Fix the workflow YAML keys in
.github/workflows/health-check.yml at lines 5-6 by removing the stray “on: read”
block and retaining one valid on: mapping. Apply the same removal in
.github/workflows/trivy-weekly.yml at lines 5-6, also remove its duplicate
permissions: block, and ensure each workflow contains exactly one on: mapping.
In @.github/workflows/hyper-agents-ci.yml:
- Around line 3-6: Remove the stray top-level “on: read” block from
.github/workflows/hyper-agents-ci.yml (lines 3-6),
.github/workflows/hyper-agents-gate2-e2e.yml (lines 3-6),
.github/workflows/iac-scan.yml (lines 3-6), .github/workflows/lean-review.yml
(lines 3-6), .github/workflows/no-legacy-paths.yml (lines 3-6),
.github/workflows/playwright-dashboard.yml (lines 3-6),
.github/workflows/promote-dashboards.yml (lines 3-6), and
.github/workflows/prune_audit.yml (lines 3-6), preserving each workflow’s valid
event mapping.</code>
In @.github/workflows/performance.yml:
- Around line 6-7: Remove the stray read entry from the on: trigger blocks in
.github/workflows/performance.yml (lines 6-7), .github/workflows/sse-tests.yml
(lines 5-6), .github/workflows/ci-security.yml (lines 3-4),
.github/workflows/docker-build.yml (lines 5-6),
.github/workflows/docker-push.yml (lines 5-6),
.github/workflows/swarm-pipeline.yml (lines 5-6), .github/workflows/tests.yml
(lines 5-6), and .github/workflows/trivy-scan.yml (lines 5-6); preserve all
existing workflow events, and only add read under permissions: if read-only
access was intended.
In @.github/workflows/trivy-scan.yml:
- Around line 3-4: Update the workflow permissions block in trivy-scan.yml to
retain contents: read and add security-events: write, ensuring
github/codeql-action/upload-sarif@v4 can upload SARIF results.
---
Outside diff comments:
In `@tatus` --short:
- Around line 1-869: Delete the accidentally committed Git output file named
“tatus --short” from the repository; it is not source code and should not be
replaced or regenerated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f7724cfc-2b48-45f5-972d-7910376ad00e
📒 Files selected for processing (35)
.github/dependabot.yml.github/workflows/accessibility.yml.github/workflows/ci-cd.yml.github/workflows/ci-integration.yml.github/workflows/ci-js.yml.github/workflows/ci-python.yml.github/workflows/ci-security.yml.github/workflows/ci-unit.yml.github/workflows/docker-build.yml.github/workflows/docker-push.yml.github/workflows/docker.yml.github/workflows/docs-check.yml.github/workflows/docs-lint.yml.github/workflows/evo-harness.yml.github/workflows/health-check.yml.github/workflows/health.yml.github/workflows/hyper-agents-ci.yml.github/workflows/hyper-agents-gate2-e2e.yml.github/workflows/iac-scan.yml.github/workflows/lean-review.yml.github/workflows/no-legacy-paths.yml.github/workflows/performance.yml.github/workflows/playwright-dashboard.yml.github/workflows/promote-dashboards.yml.github/workflows/prune_audit.yml.github/workflows/quality-gate.yml.github/workflows/secret-redaction-guard.yml.github/workflows/security-comprehensive.yml.github/workflows/sse-tests.yml.github/workflows/swarm-pipeline.yml.github/workflows/tests.yml.github/workflows/trivy-scan.yml.github/workflows/trivy-weekly.ymlHyperCode-V2.4tatus --short
| permissions: | ||
| contents: read | ||
| on: | ||
| read | ||
| on: | ||
| push: | ||
| branches: [main, master] | ||
| pull_request: | ||
| branches: [main, master] | ||
| workflow_dispatch: | ||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
| jobs: | ||
| lint: |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Remove invalid GitHub Actions syntax from the Dependabot configuration.
GitHub Actions workflow syntax (such as permissions, on, concurrency, and jobs) has been mistakenly added to this file. The .github/dependabot.yml file uses a strict schema that does not support these keys, and their presence will cause parsing to fail, breaking Dependabot updates entirely. Furthermore, there are duplicate and malformed on: keys.
Please remove these lines completely, as they are only valid inside workflow files (e.g. .github/workflows/*.yml).
🐛 Proposed fix to remove the invalid configuration
- permissions:
- contents: read
- on:
- read
- on:
- push:
- branches: [main, master]
- pull_request:
- branches: [main, master]
- workflow_dispatch:
- concurrency:
- group: ${{ github.workflow }}-${{ github.ref }}
- cancel-in-progress: true
- jobs:
- lint:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| on: | |
| read | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 7 - 21, Remove the GitHub Actions
workflow keys from .github/dependabot.yml, including permissions, both on
entries, concurrency, and jobs with its lint block; retain only valid Dependabot
configuration entries.
| inputs: | ||
|
|
||
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .github/workflows/ci-js.yml
echo '---'
cat -n .github/workflows/ci-js.yml | sed -n '1,80p'Repository: welshDog/HyperCode-V2.4
Length of output: 3472
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check GitHub Actions schema docs in the workflow file context if needed
rg -n "permissions|workflow_call|inputs|secrets|outputs" .github/workflows/ci-js.ymlRepository: welshDog/HyperCode-V2.4
Length of output: 1560
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/ci-js.yml')
print(p.exists())
if p.exists():
txt=p.read_text()
print(txt)
PYRepository: welshDog/HyperCode-V2.4
Length of output: 4089
🏁 Script executed:
#!/bin/bash
set -euo pipefail
cat -n .github/workflows/ci-js.yml | sed -n '1,80p'Repository: welshDog/HyperCode-V2.4
Length of output: 3440
Move permissions out of workflow_call. on.workflow_call only supports inputs, secrets and outputs; the stray empty inputs: entry here should go too so the reusable workflow parses cleanly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-js.yml around lines 5 - 8, Update the workflow
configuration by removing the empty inputs entry from the workflow_call section
and moving the contents read permissions block to the workflow’s top level,
outside workflow_call, so the reusable workflow uses only supported
workflow_call keys.
| permissions: | ||
| contents: readname: CI — Python |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Restore a valid workflow header and remove the duplicate permissions block.
contents: readname: CI — Python is malformed YAML and loses the workflow name. Keep one top-level block, for example:
- contents: readname: CI — Python
+ contents: read
+name: CI — Python
...
-permissions:
- contents: readAlso applies to: 17-18
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-python.yml around lines 1 - 2, Fix the top-level header
in the CI workflow by separating the workflow name from the permissions
declaration into valid YAML, preserving the intended `CI — Python` name and a
single `contents: read` permissions block. Remove the duplicate permissions
block referenced by the comment.
| on: | ||
| read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Remove invalid on: read triggers and duplicate keys across workflows.
The read event is not a recognised GitHub Actions trigger. Adding these on: blocks also creates duplicate YAML keys, as the actual event triggers are already defined elsewhere in these files. This malformed syntax will cause the YAML parser to fail and prevent the workflows from running.
.github/workflows/docker.yml#L5-L6: Remove the invalidon: readblock..github/workflows/docs-check.yml#L5-L6: Remove the invalidon: readblock..github/workflows/docs-lint.yml#L5-L6: Remove the invalidon: readblock..github/workflows/evo-harness.yml#L8-L9: Remove the invalidon: readblock..github/workflows/health.yml#L5-L6: Remove the invalidon: readblock..github/workflows/quality-gate.yml#L9-L10: Remove the invalidon: readblock..github/workflows/secret-redaction-guard.yml#L9-L10: Remove the invalidon: readblock..github/workflows/security-comprehensive.yml#L5-L8: Remove both invalidon: readblocks.
📍 Affects 8 files
.github/workflows/docker.yml#L5-L6(this comment).github/workflows/docs-check.yml#L5-L6.github/workflows/docs-lint.yml#L5-L6.github/workflows/evo-harness.yml#L8-L9.github/workflows/health.yml#L5-L6.github/workflows/quality-gate.yml#L9-L10.github/workflows/secret-redaction-guard.yml#L9-L10.github/workflows/security-comprehensive.yml#L5-L8
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docker.yml around lines 5 - 6, Remove the invalid
duplicate “on: read” blocks from .github/workflows/docker.yml (lines 5-6),
docs-check.yml (5-6), docs-lint.yml (5-6), evo-harness.yml (8-9), health.yml
(5-6), quality-gate.yml (9-10), and secret-redaction-guard.yml (9-10). In
.github/workflows/security-comprehensive.yml (5-8), remove both invalid blocks
while preserving each workflow’s existing valid event triggers.
| on: | ||
| read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in .github/workflows/health-check.yml .github/workflows/trivy-weekly.yml; do
echo "== $f =="
nl -ba "$f" | sed -n '1,80p'
echo
doneRepository: welshDog/HyperCode-V2.4
Length of output: 242
🏁 Script executed:
#!/bin/bash
set -euo pipefail
for f in .github/workflows/health-check.yml .github/workflows/trivy-weekly.yml; do
echo "== $f =="
cat -n "$f" | sed -n '1,120p'
echo
doneRepository: welshDog/HyperCode-V2.4
Length of output: 8806
🌐 Web query:
GitHub Actions workflow duplicate top-level keys YAML duplicate on key behaviour
💡 Result:
In GitHub Actions, the presence of duplicate top-level keys or duplicate keys within any mapping in a workflow YAML file is treated as a critical syntax error [1][2]. Unlike some standard YAML parsers—which may silently accept duplicates by either using the first occurrence or overwriting it with the last—GitHub Actions uses a strict parser that will reject the file entirely [1][2]. If your workflow contains duplicate keys, it will fail to load, and no jobs will be triggered [1][2]. You will typically encounter an error message indicating that a specific key is already defined [2]. Key aspects of this behavior include: 1. Case-insensitivity: For certain keys in GitHub Actions, the parser treats keys as case-insensitive [3][4]. Consequently, you cannot have duplicate keys even if the capitalization differs (e.g., matrix and MATRIX are treated as the same key) [3][4]. 2. Strict Parsing: Because GitHub Actions employs a strict parser, you cannot rely on local linting tools that use permissive YAML parsers (like standard Python PyYAML) to validate your workflow, as those tools might not flag the duplicates that GitHub will [2]. 3. Prevention: To avoid this issue, it is recommended to use specialized linting tools such as actionlint, which are specifically designed to catch GitHub Actions-compliant syntax errors, including duplicate keys, before you commit or push your code [3][4]. Alternatively, configuring a generic YAML linter like yamllint with the key-duplicates rule enabled is an effective way to detect these errors in your CI pipeline [5].
Citations:
- 1: paruff/prei@412942f
- 2: GoPlasmatic/datalogic-rs@3df1d7c
- 3: https://github.com/rhysd/actionlint/blob/main/docs/checks.md
- 4: https://github.com/rhysd/actionlint/blob/v1.7.12/docs/checks.md
- 5: code/app-mattermost@9c8191c
Fix the workflow keys
on: read is a stray top-level key, and both workflows define on: twice; .github/workflows/trivy-weekly.yml also defines permissions: twice. That will prevent GitHub Actions from loading the workflows.
.github/workflows/health-check.yml: remove the strayon: readblock and keep a singleon:mapping..github/workflows/trivy-weekly.yml: remove the strayon: readblock, drop the duplicatepermissions:block, and keep a singleon:mapping.
📍 Affects 2 files
.github/workflows/health-check.yml#L5-L6(this comment).github/workflows/trivy-weekly.yml#L5-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/health-check.yml around lines 5 - 6, Fix the workflow YAML
keys in .github/workflows/health-check.yml at lines 5-6 by removing the stray
“on: read” block and retaining one valid on: mapping. Apply the same removal in
.github/workflows/trivy-weekly.yml at lines 5-6, also remove its duplicate
permissions: block, and ensure each workflow contains exactly one on: mapping.
| permissions: | ||
| contents: read | ||
| on: | ||
| read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
files=(
.github/workflows/hyper-agents-ci.yml
.github/workflows/hyper-agents-gate2-e2e.yml
.github/workflows/iac-scan.yml
.github/workflows/lean-review.yml
.github/workflows/no-legacy-paths.yml
.github/workflows/playwright-dashboard.yml
.github/workflows/promote-dashboards.yml
.github/workflows/prune_audit.yml
)
for file in "${files[@]}"; do
test "$(grep -cE '^on:$' "$file")" -eq 1
! grep -qE '^ read$' "$file"
doneRepository: welshDog/HyperCode-V2.4
Length of output: 161
🏁 Script executed:
#!/bin/bash
set -euo pipefail
files=(
.github/workflows/hyper-agents-ci.yml
.github/workflows/hyper-agents-gate2-e2e.yml
.github/workflows/iac-scan.yml
.github/workflows/lean-review.yml
.github/workflows/no-legacy-paths.yml
.github/workflows/playwright-dashboard.yml
.github/workflows/promote-dashboards.yml
.github/workflows/prune_audit.yml
)
for file in "${files[@]}"; do
echo "===== $file ====="
sed -n '1,30p' "$file" | cat -n
echo
doneRepository: welshDog/HyperCode-V2.4
Length of output: 7017
Remove the stray on: read block from these workflows. read is not a GitHub Actions trigger, and the duplicate top-level on key can mask the real event mapping. Affects .github/workflows/hyper-agents-ci.yml, .github/workflows/hyper-agents-gate2-e2e.yml, .github/workflows/iac-scan.yml, .github/workflows/lean-review.yml, .github/workflows/no-legacy-paths.yml, .github/workflows/playwright-dashboard.yml, .github/workflows/promote-dashboards.yml, and .github/workflows/prune_audit.yml.
📍 Affects 8 files
.github/workflows/hyper-agents-ci.yml#L3-L6(this comment).github/workflows/hyper-agents-gate2-e2e.yml#L3-L6.github/workflows/iac-scan.yml#L3-L6.github/workflows/lean-review.yml#L3-L6.github/workflows/no-legacy-paths.yml#L3-L6.github/workflows/playwright-dashboard.yml#L3-L6.github/workflows/promote-dashboards.yml#L3-L6.github/workflows/prune_audit.yml#L3-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/hyper-agents-ci.yml around lines 3 - 6, Remove the stray
top-level “on: read” block from .github/workflows/hyper-agents-ci.yml (lines
3-6), .github/workflows/hyper-agents-gate2-e2e.yml (lines 3-6),
.github/workflows/iac-scan.yml (lines 3-6), .github/workflows/lean-review.yml
(lines 3-6), .github/workflows/no-legacy-paths.yml (lines 3-6),
.github/workflows/playwright-dashboard.yml (lines 3-6),
.github/workflows/promote-dashboards.yml (lines 3-6), and
.github/workflows/prune_audit.yml (lines 3-6), preserving each workflow’s valid
event mapping.</code>
| on: | ||
| read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
files=(
.github/workflows/performance.yml
.github/workflows/sse-tests.yml
.github/workflows/ci-security.yml
.github/workflows/docker-build.yml
.github/workflows/docker-push.yml
.github/workflows/swarm-pipeline.yml
.github/workflows/tests.yml
.github/workflows/trivy-scan.yml
)
for f in "${files[@]}"; do
echo "===== $f ====="
nl -ba "$f" | sed -n '1,40p'
echo
doneRepository: welshDog/HyperCode-V2.4
Length of output: 248
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n '^\s*on:\s*$|^\s*read\s*$' .github/workflows/*.ymlRepository: welshDog/HyperCode-V2.4
Length of output: 3878
Remove the stray read line from these workflow trigger blocks. It sits under on: and makes the workflow YAML invalid; if the intent was read-only access, move it under permissions: and leave the existing events unchanged.
.github/workflows/performance.yml.github/workflows/sse-tests.yml.github/workflows/ci-security.yml.github/workflows/docker-build.yml.github/workflows/docker-push.yml.github/workflows/swarm-pipeline.yml.github/workflows/tests.yml.github/workflows/trivy-scan.yml
📍 Affects 8 files
.github/workflows/performance.yml#L6-L7(this comment).github/workflows/sse-tests.yml#L5-L6.github/workflows/ci-security.yml#L3-L4.github/workflows/docker-build.yml#L5-L6.github/workflows/docker-push.yml#L5-L6.github/workflows/swarm-pipeline.yml#L5-L6.github/workflows/tests.yml#L5-L6.github/workflows/trivy-scan.yml#L5-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/performance.yml around lines 6 - 7, Remove the stray read
entry from the on: trigger blocks in .github/workflows/performance.yml (lines
6-7), .github/workflows/sse-tests.yml (lines 5-6),
.github/workflows/ci-security.yml (lines 3-4),
.github/workflows/docker-build.yml (lines 5-6),
.github/workflows/docker-push.yml (lines 5-6),
.github/workflows/swarm-pipeline.yml (lines 5-6), .github/workflows/tests.yml
(lines 5-6), and .github/workflows/trivy-scan.yml (lines 5-6); preserve all
existing workflow events, and only add read under permissions: if read-only
access was intended.
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,220p' .github/workflows/trivy-scan.yml
printf '\n---\n'
rg -n "upload-sarif|security-events|permissions:" .github/workflows -SRepository: welshDog/HyperCode-V2.4
Length of output: 4656
🌐 Web query:
github codeql action upload-sarif security-events write permission
💡 Result:
To use the GitHub CodeQL upload-sarif action, your workflow job must be granted security-events: write permission [1][2]. This permission allows the action to upload SARIF results to GitHub Code Scanning [3][4]. Key considerations include: 1. Permission Scope: When you explicitly define a permissions block in your workflow or at the job level, GitHub overrides the default permissions and grants only those you specify [5]. If you do not include security-events: write in your explicit block, the action will fail with a "Resource not accessible" error [6][7]. 2. Implementation: You can grant this permission at the workflow level or the specific job level where the action runs [5]. Example configuration: permissions: contents: read security-events: write 3. Token usage: The upload-sarif action requires the built-in GITHUB_TOKEN to function correctly for uploading to Code Scanning [1][8]. While the action includes a token input, it is generally intended for the built-in token, and using custom personal access tokens (PATs) for this specific action is often not supported or necessary [8]. 4. Best Practices: If your repository is private, ensure you also grant contents: read permissions so the action can access the repository source code [2]. Following the principle of least privilege, explicitly defining only the required permissions (e.g., contents: read and security-events: write) is recommended to secure your workflow [5][4].
Citations:
- 1: https://github.com/github/codeql-action/blob/main/upload-sarif/action.yml
- 2: https://github.com/github/codeql-action/
- 3: https://docs.github.com/actions/using-workflows/workflow-syntax-for-github-actions
- 4: https://adaptive-enforcement-lab.com/secure/github-actions-security/cheat-sheet/
- 5: https://www.kenmuse.com/blog/github-actions-workflow-permissions/
- 6: codeql/upload-sarif@v2 or @main can't integrate on actions github/codeql-action#1806
- 7: codeql/upload-sarif@v3 action failed: Resource not accessible by integration - missing
actions: readgithub/codeql-action#2117 - 8: upload-sarif: token input doesn't work github/codeql-action#2386
Add security-events: write to .github/workflows/trivy-scan.yml. github/codeql-action/upload-sarif@v4 needs that permission; with only contents: read, the SARIF upload will fail.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/trivy-scan.yml around lines 3 - 4, Update the workflow
permissions block in trivy-scan.yml to retain contents: read and add
security-events: write, ensuring github/codeql-action/upload-sarif@v4 can upload
SARIF results.
1 participant
Audit and normalize GitHub Actions workflow permissions to reduce early checkout and policy failures.
Summary by CodeRabbit
Security
Maintenance
Updates