Skip to content

Migrate to reusable workflows #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mbrousset-ledger wants to merge 1 commit into from
Closed

Migrate to reusable workflows #19

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
name: CodeQL

on:
workflow_dispatch:
push:
branches:
- main
- master
- develop
pull_request:

jobs:
analyse:
name: Call Ledger CodeQL analysis
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_codeql_checks.yml@v1
secrets: inherit
Comment on lines +14 to +16

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 3 months ago

In general, the fix is to add an explicit permissions: block that grants only the minimal required scopes for the GITHUB_TOKEN, either at the workflow root (applies to all jobs) or under the specific job. Since this workflow only forwards to a reusable workflow and there is no indication it needs write access, we can safely start with a read-only configuration (e.g., contents: read), which aligns with GitHub’s recommended baseline.

The most direct fix without altering existing behavior is to add a permissions: section at the top workflow level, just after the on: block and before jobs:. This will apply to the analyse job unless that job or the called reusable workflow overrides permissions. We’ll set permissions: contents: read, which is the standard “read-only” baseline and is very unlikely to break a CodeQL analysis workflow, as it primarily needs to read repository contents. No imports or additional methods are needed; it’s a pure YAML configuration change within .github/workflows/codeql.yml.

Concretely, in .github/workflows/codeql.yml, after line 10 (pull_request:) and before line 12 (jobs:), insert:

permissions:
  contents: read

This documents and constrains the token permissions for the workflow.

Suggested changeset 1
.github/workflows/codeql.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -9,6 +9,9 @@
       - develop
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   analyse:
     name: Call Ledger CodeQL analysis
EOF
@@ -9,6 +9,9 @@
- develop
pull_request:

permissions:
contents: read

jobs:
analyse:
name: Call Ledger CodeQL analysis
Copilot is powered by AI and may make mistakes. Always verify output.
16 changes: 16 additions & 0 deletions .github/workflows/unit-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
name: Unit Tests

on:
workflow_dispatch:
push:
branches:
- main
- master
- develop
pull_request:

jobs:
unit_tests:
name: Unit Tests
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_unit_tests.yml@v1
secrets: inherit
Comment on lines +14 to +16

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 3 months ago

In general, the problem is fixed by explicitly specifying permissions: either at the workflow level (top of the file) or at the job level, to ensure the GITHUB_TOKEN has only the minimal required scopes, typically contents: read for basic CI tasks. This prevents the workflow from unintentionally inheriting broader repository or organization defaults.

For this specific workflow, which only delegates to a reusable workflow and does not itself perform write operations, the safest non-breaking fix is to add a permissions: block that grants read-only access to repository contents. Because job-level permissions will be passed to the reusable workflow unless that workflow defines stricter permissions, we should add the block under the unit_tests job. The minimal and conservative setting is:

permissions:
  contents: read

This should be placed under jobs: unit_tests: alongside name, uses, and secrets, properly indented. No additional imports or other code changes are required.

Concretely, in .github/workflows/unit-tests.yml, edit the unit_tests job definition (around lines 13–17) to insert a permissions: section between name: Unit Tests and uses: .... This preserves existing behavior while constraining the default token privileges to read-only repository contents, which is appropriate for running unit tests via a reusable workflow.

Suggested changeset 1
.github/workflows/unit-tests.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -12,5 +12,7 @@
 jobs:
   unit_tests:
     name: Unit Tests
+    permissions:
+      contents: read
     uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_unit_tests.yml@v1
     secrets: inherit
EOF
@@ -12,5 +12,7 @@
jobs:
unit_tests:
name: Unit Tests
permissions:
contents: read
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_unit_tests.yml@v1
secrets: inherit
Copilot is powered by AI and may make mistakes. Always verify output.
Loading