Fix token permissions: move security-events:write to job-level (Scorecard alert #571) - #5473
Draft
Alan Jowett (Alan-Jowett) with Copilot wants to merge 2 commits into
Draft
Fix token permissions: move security-events:write to job-level (Scorecard alert #571)#5473Alan Jowett (Alan-Jowett) with Copilot wants to merge 2 commits into
Alan Jowett (Alan-Jowett) with Copilot wants to merge 2 commits into
Conversation
Copilot
AI
changed the title
[WIP] Fix code scanning alert 571
Fix token permissions: move security-events:write to job-level (Scorecard alert #571)
Jul 30, 2026
Contributor
Comment on lines
23
to
27
| permissions: | ||
| id-token: write # Required to log in to Azure. | ||
| contents: read | ||
| checks: read # Required by reusable-test.yml to check build status. | ||
| security-events: write # Required by codeql task. | ||
| issues: write # Required to create issues. |
Collaborator
There was a problem hiding this comment.
There's only one job, and it has its own permission block. Can we remove the workflow-level permissions block all together?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Scorecard flagged
security-events: writeset at the top-level workflow permissions incicd-release-validation.yml(since consolidated intocicd.yml), violating least-privilege for the GITHUB_TOKEN. Write permissions at the top level apply to all jobs in the workflow, not just those that need them.Changes:
cicd.yml: Removesecurity-events: writefrom top-level permissions; add it at job-level for theossarjob only (withchecks: readandcontents: readalso scoped to that job, matching whatossar-scan.ymlrequires)codeql.yml: Same pattern — remove from top-level, add at job-level for thecodeqljob that callsreusable-build.ymlwithbuild_codeql: truereusable-build.yml: Addsecurity-events: writeto the workflow permissions declaration, since it usesgithub/codeql-action/analyzewhenbuild_codeql: trueTesting
No code changes. Existing CI workflows validate that GitHub Actions YAML is syntactically valid. No new tests needed.
Documentation
No documentation impact.
Installation
No installer impact.