Conversation
❌ Deploy Preview for animated-kangaroo-b914c6 failed.
|
❌ Deploy Preview for wheresreligion failed. Why did it fail? →
|
❌ Deploy Preview for taupe-cactus-43ebc8 failed.
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
… admin button, prevent unauthorized access to comments
…eign-key-columns Added indexing to database for foreign key columns.
| name: Build & Deploy Docs | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup pnpm | ||
| uses: pnpm/action-setup@v4 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: '24.x' | ||
| cache: 'pnpm' | ||
|
|
||
| - name: Install dependencies | ||
| run: pnpm install --frozen-lockfile | ||
|
|
||
| - name: Build & deploy docs | ||
| run: pnpm deploy:docs | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
In general, the fix is to explicitly define a permissions block for the workflow or for the specific job so that GITHUB_TOKEN has only the minimal required scopes. For this workflow, the job appears only to read repository contents (via actions/checkout) and then use external secrets to deploy, so contents: read is a suitable minimal starting point.
The single best way to fix this without changing existing functionality is to add a permissions block under the deploy job (or at the top level) setting contents: read. This matches the CodeQL suggestion and GitHub’s minimal recommendation, and it avoids granting any unnecessary write permissions. Concretely, in .github/workflows/deploy-docs.yml, under jobs: deploy:, add a permissions: section with contents: read, keeping indentation consistent with other job-level keys such as name and runs-on. No additional imports, methods, or other definitions are needed.
| @@ -11,6 +11,8 @@ | ||
| deploy: | ||
| name: Build & Deploy Docs | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
2 participants
Experimental - DO NOT MERGE