From 51628d3f1664ce1b3742782899a9dfdd0bb6553e Mon Sep 17 00:00:00 2001 From: Esta Nagy Date: Sun, 28 Jul 2024 22:07:09 +0200 Subject: [PATCH] Update codeql-analysis.yml - Restricts permissions of CodeQL workflow - Runs CodeQL scanning on every build of the "main" branch {patch} Signed-off-by: Esta Nagy --- .github/workflows/codeql-analysis.yml | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 75fb6492..78fc6cd1 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -15,22 +15,6 @@ name: "CodeQL" on: push: branches: [ main ] - paths-ignore: - - 'README.md' - - '**/README.md' - - 'CODE_OF_CONDUCT.md' - - 'CONTRIBUTING.md' - - 'pull_request_template.md' - - 'SECURITY.md' - - 'LICENSE' - - '.github/ISSUE_TEMPLATE/**' - - '.github/assets/**' - - '.github/workflows/**' - - '!.github/workflows/codeql-analysis.yml' - - '.github/pr-labeler.yml' - - 'renovate.json' - - '.whitesource' - - 'lowkey-vault-docker/src/docker/Dockerfile' pull_request: # The branches below must be a subset of the branches above branches: [ main ] @@ -53,9 +37,6 @@ on: - 'lowkey-vault-docker/src/docker/Dockerfile' permissions: - # required for all workflows - security-events: write - # only required for workflows in private repositories actions: read contents: read @@ -64,6 +45,10 @@ jobs: analyze: name: Analyze runs-on: ubuntu-latest + + permissions: + # required for all workflows + security-events: write steps: - name: Checkout repository