github-starred/awesome-compose
2
0
Fork 0
mirror of https://github.com/docker/awesome-compose.git synced 2026-07-16 13:21:57 -05:00
Code Issues 9.3k Packages Projects Releases Wiki Activity

[PR #747] ci(codeql-analysis): cap GITHUB_TOKEN to contents: read #11330

New Issue
Open
opened 2026-06-06 16:30:34 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-06-06 16:30:34 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/docker/awesome-compose/pull/747
Author: @arpitjain099
Created: 5/25/2026
Status: 🔄 Open

Base: master ← Head: chore/declare-workflow-perms

📝 Commits (1)

  • b6a5ec3 ci(codeql-analysis): cap GITHUB_TOKEN to contents: read

📊 Changes

1 file changed (+3 additions, -0 deletions)

View changed files

📝 .github/workflows/codeql-analysis.yml (+3 -0)

📄 Description

Adds workflow-level permissions: contents: read. The analyze job-level security-events: write is intentionally untouched (jobs override the workflow-level cap upward where genuinely needed).

Post-CVE-2025-30066 (tj-actions/changed-files) hardening pattern. YAML validated locally.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/docker/awesome-compose/pull/747 **Author:** [@arpitjain099](https://github.com/arpitjain099) **Created:** 5/25/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `chore/declare-workflow-perms` --- ### 📝 Commits (1) - [`b6a5ec3`](https://github.com/docker/awesome-compose/commit/b6a5ec32d626e59132682d3d063d703f6cf83d58) ci(codeql-analysis): cap GITHUB_TOKEN to contents: read ### 📊 Changes **1 file changed** (+3 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/codeql-analysis.yml` (+3 -0) </details> ### 📄 Description Adds workflow-level `permissions: contents: read`. The analyze job-level `security-events: write` is intentionally untouched (jobs override the workflow-level cap upward where genuinely needed). Post-CVE-2025-30066 (`tj-actions/changed-files`) hardening pattern. YAML validated locally. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-06-06 16:30:34 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
good first issue
proposal
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/awesome-compose#11330
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?