Potential fix for code scanning alert no. 1: Workflow does not contain permissions#110
Potential fix for code scanning alert no. 1: Workflow does not contain permissions#110glenn-jocher merged 3 commits intomainfrom
Conversation
…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Glenn Jocher <glenn.jocher@ultralytics.com>
Signed-off-by: Glenn Jocher <glenn.jocher@ultralytics.com>
|
👋 Hello @glenn-jocher, thank you for submitting an
For more guidance, please refer to our Contributing Guide. Don’t hesitate to leave a comment if you have any questions. Thank you for contributing to Ultralytics! 🚀 🛠️ PR SummaryMade with ❤️ by Ultralytics Actions 🌟 SummaryAdds explicit write permissions to the GitHub Actions “Tag and Release” workflow to ensure it can create tags and releases ✅ 📊 Key Changes
🎯 Purpose & Impact
|
|
🎉 Great merge, @glenn-jocher — thank you! “Simplicity is the ultimate sophistication.” — Leonardo da Vinci. Your update to set explicit Appreciate the clean, pragmatic improvement! See details in the merged pull request #110. 🙌 |
Potential fix for https://github.com/ultralytics/assets/security/code-scanning/1
To fix the problem, explicitly declare the least-privileged
permissionsblock in the workflow configuration. This should be set at the root level (applies to all jobs unless overridden), or directly within thetag-and-releasejob definition. For this workflow, since it creates tags and releases, it needscontents: write(for tagging and release creation). If the workflow also uses the API in other ways (e.g., managing issues or PRs), other permissions may be required, but for the observed steps,contents: writeshould suffice.The minimal fix is to add:
at the root of the YAML file (after the
namekey and beforeon:), applying least privilege for the necessary GITHUB_TOKEN operations.Specifically:
.github/workflows/tag.ymlname: Tag and Release.No additional imports or external code are required.
Suggested fixes powered by Copilot Autofix. Review carefully before merging.
🛠️ PR Summary
Made with ❤️ by Ultralytics Actions
🌟 Summary
Adds explicit GitHub Actions permissions to allow the Tag and Release workflow to create tags/releases reliably. 🔧🚀
📊 Key Changes
contents: writein.github/workflows/tag.yml.🎯 Purpose & Impact
GITHUB_TOKEN, preventing permission-related failures. ✅