chore: Added notify-changelog workflow #1532
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| timeout-minutes: 3 | ||
|
|
||
| steps: | ||
| - name: Notify changelog of new release | ||
| uses: peter-evans/repository-dispatch@v1 | ||
| with: | ||
| token: ${{ secrets.DISPATCH_ACCESS_TOKEN }} | ||
| repository: box/box-developer-changelog | ||
| event-type: new-release-note | ||
| client-payload: '{"ref": "${{ github.ref }}", "repository": "${{github.repository}}", "labels": "sdks,java", "repo_display_name": "Box Java SDK"}' |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 3 months ago
The best fix is to explicitly restrict the GITHUB_TOKEN permissions at the earliest reasonable scope. In this workflow, that can be at the workflow level (root), or job level (notify). Given there is only one job, placing it at the workflow level for clarity is the most future-proof for potential additional jobs. Since this workflow appears to notify an external repository using the repository-dispatch action, only contents: read is required for most cases (access to the repository's contents). As the action is provided a personal access token via ${{ secrets.DISPATCH_ACCESS_TOKEN }} and does not use the default GITHUB_TOKEN for dispatch, it likely needs no special write rights at all. Therefore, set permissions: contents: read at the workflow root, granting the minimum access needed.
- Add, after the
name:line and beforeon:, in.github/workflows/notify-changelog.yml:permissions: contents: read
| @@ -2,6 +2,8 @@ | ||
| # changelog repository of any new releases. | ||
|
|
||
| name: Notify changelog | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| # Only trigger for a full release, |
Pull Request Test Coverage Report for Build #5405Details
💛 - Coveralls |
Pull Request Test Coverage Report for Build #5406Details
💛 - Coveralls |
No description provided.