Skip to content

Migrate to reusable workflows #93

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
mbrousset-ledger wants to merge 1 commit into from
Closed

Migrate to reusable workflows #93

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
name: CodeQL

on:
workflow_dispatch:
push:
branches:
- main
- master
- develop
pull_request:

jobs:
analyse:
name: Call Ledger CodeQL analysis
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_codeql_checks.yml@v1
secrets: inherit
Comment on lines +14 to +16

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

In general, the fix is to explicitly declare permissions for the GITHUB_TOKEN either at the workflow root (applies to all jobs) or at the job level (applies only to that job), and to restrict them to the minimal access needed. For a typical CodeQL analysis workflow that only needs to read the repository contents and security events, GitHub’s own starter workflows use read-only or narrowly scoped permissions such as actions: read, contents: read, and security-events: write.

The single best way to fix this without changing existing functionality is to add a permissions block under the analyse job. This keeps the change local to the job highlighted by CodeQL and avoids affecting any other jobs that might later be added to the workflow. A safe, least‑privilege set matching GitHub’s recommended CodeQL configuration is:

permissions:
  actions: read
  contents: read
  security-events: write

These lines should be indented to align with the other keys under analyse (e.g., name, uses, secrets) in .github/workflows/codeql.yml. No additional methods, imports, or definitions are needed because this is pure workflow configuration.

Suggested changeset 1
.github/workflows/codeql.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -12,5 +12,9 @@
 jobs:
   analyse:
     name: Call Ledger CodeQL analysis
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_codeql_checks.yml@v1
     secrets: inherit
EOF
@@ -12,5 +12,9 @@
jobs:
analyse:
name: Call Ledger CodeQL analysis
permissions:
actions: read
contents: read
security-events: write
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_codeql_checks.yml@v1
secrets: inherit
Copilot is powered by AI and may make mistakes. Always verify output.
16 changes: 16 additions & 0 deletions .github/workflows/unit-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
name: Unit Tests

on:
workflow_dispatch:
push:
branches:
- main
- master
- develop
pull_request:

jobs:
unit_tests:
name: Unit Tests
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_unit_tests.yml@v1
secrets: inherit
Comment on lines +14 to +16

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

In general, the fix is to add an explicit permissions block that grants the least privileges necessary for the workflow. For a unit-test workflow that just checks out code and runs tests, contents: read is typically sufficient. Since this job delegates to a reusable workflow, the best non-breaking change is to define a conservative, read-only permission set at the job level; if the reusable workflow needs additional, more specific write scopes, they can be added later based on actual needs.

Concretely, in .github/workflows/unit-tests.yml, under the unit_tests job (around line 14), add a permissions: section aligned with the existing keys (name, uses, secrets). The minimal, safe block is:

permissions:
  contents: read

This limits the GITHUB_TOKEN to read repository contents while leaving the rest unchanged. No imports, methods, or other definitions are needed, as this is a pure YAML configuration change inside the shown file and snippet.

Suggested changeset 1
.github/workflows/unit-tests.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -12,5 +12,7 @@
 jobs:
   unit_tests:
     name: Unit Tests
+    permissions:
+      contents: read
     uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_unit_tests.yml@v1
     secrets: inherit
EOF
@@ -12,5 +12,7 @@
jobs:
unit_tests:
name: Unit Tests
permissions:
contents: read
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_unit_tests.yml@v1
secrets: inherit
Copilot is powered by AI and may make mistakes. Always verify output.
Loading