Align 1952 with main - #21
Conversation
Add xchem-style release files
- Switch to pyproject.toml for package build - Adds dependencies not originally listed - Adds versions to dependencies
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Build distribution | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Inject slug/short variables | ||
| uses: rlespinasse/github-slug-action@v5 | ||
| - name: Set up Python | ||
| uses: actions/setup-python@v6 | ||
| with: | ||
| python-version: '3.x' | ||
| - name: Install build package | ||
| run: | | ||
| pip install --upgrade pip | ||
| pip install uv --user | ||
| - name: Build | ||
| run: | | ||
| uv version $GITHUB_REF_SLUG | ||
| uv build | ||
| - name: Store the distribution | ||
| uses: actions/upload-artifact@v5 | ||
| with: | ||
| name: python-package-distribution | ||
| path: dist/ | ||
|
|
||
| publish: |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
In general, the fix is to explicitly restrict the GITHUB_TOKEN permissions for the workflow/jobs so they only have the minimum required access. For this workflow, the build job only needs to read repository contents and interact with artifacts; it does not need to write to the repo, issues, or PRs. The publish job already correctly grants id-token: write and otherwise inherits defaults, so we can keep that as-is or further restrict if desired; the CodeQL finding is specifically on the build job.
The best minimal fix without changing existing functionality is to add a permissions block to the build job that limits contents to read. This satisfies CodeQL’s recommendation (contents: read as a minimal starting point), matches what actions/checkout requires, and avoids unintentionally broad write permissions. Concretely, in .github/workflows/release.yaml, inside jobs.build (below runs-on: ubuntu-latest is a clear spot), add:
permissions:
contents: readNo new imports or methods are needed; this is purely a workflow YAML change.
| @@ -15,6 +15,8 @@ | ||
| build: | ||
| name: Build distribution | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v6 |
3 participants
No description provided.