nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 21:18:13 -05:00
Code

Adjust scan permissions (#3931)

Browse Source
This commit is contained in:
Matt Bishop 2024-03-27 12:35:24 -04:00 committed by GitHub
parent 2790687dc2
commit a390fcafaf
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
.github/workflows/scan.yml vendored
View File

@ -10,8 +10,6 @@ on:
pull_request_target: pull_request_target:
types: [opened, synchronize] types: [opened, synchronize]
permissions: read-all
jobs: jobs:
check-run: check-run:
name: Check PR run name: Check PR run
@ -22,6 +20,8 @@ jobs:
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
needs: check-run needs: check-run
permissions: permissions:
contents: read
pull-requests: write
security-events: write security-events: write
steps: steps:
@ -43,7 +43,7 @@ jobs:
additional_params: --report-format sarif --output-path . ${{ env.INCREMENTAL }} additional_params: --report-format sarif --output-path . ${{ env.INCREMENTAL }}
- name: Upload Checkmarx results to GitHub - name: Upload Checkmarx results to GitHub
uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
with: with:
sarif_file: cx_result.sarif sarif_file: cx_result.sarif
@ -51,6 +51,9 @@ jobs:
name: Quality scan name: Quality scan
runs-on: ubuntu-22.04 runs-on: ubuntu-22.04
needs: check-run needs: check-run
permissions:
contents: read
pull-requests: write
steps: steps:
- name: Check out repo - name: Check out repo