Potential fix for code scanning alert no. 30: Workflow does not contain permissions#21121
Conversation
…in permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
|
One or more co-authors of this pull request were not found. You must specify co-authors in commit message trailer via: Supported
Alternatively, if the co-author should not be included, remove the Please update your commit message(s) by doing |
|
This PR is packaged and the instant preview is available (40d23f9). Install it locally:
npm i -D webpack@https://pkg.pr.new/webpack@40d23f9
yarn add -D webpack@https://pkg.pr.new/webpack@40d23f9
pnpm add -D webpack@https://pkg.pr.new/webpack@40d23f9 |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #21121 +/- ##
==========================================
+ Coverage 91.98% 92.01% +0.02%
==========================================
Files 581 581
Lines 61441 61441
Branches 16791 16791
==========================================
+ Hits 56519 56534 +15
+ Misses 4922 4907 -15
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Merging this PR will improve performance by 30.81%
|
| Mode | Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|---|
| ❌ | Memory | benchmark "future-defaults", scenario '{"name":"mode-production","mode":"production"}' |
7.1 MB | 9 MB | -21.44% |
| ⚡ | Memory | benchmark "react", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}' |
330.1 KB | 152.4 KB | ×2.2 |
| ⚡ | Memory | benchmark "asset-modules-bytes", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}' |
322.6 KB | 245.3 KB | +31.5% |
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing alert-autofix-30 (73e36f1) with main (1c36fd6)
Potential fix for https://github.com/webpack/webpack/security/code-scanning/30
Add an explicit
permissionsblock with least privilege to the workflow.For this workflow,
gh release viewandactions/checkoutonly require read access to repository contents, socontents: readis sufficient and does not change behavior.Best single fix:
.github/workflows/release-announcement.yml.permissions:block after the triggers (on:) and beforejobs:.contents: readNo imports, methods, or extra definitions are needed (YAML workflow config only).
Suggested fixes powered by Copilot Autofix. Review carefully before merging.