add actions: read to any job using upload-sarif

crummy · Sep 14, 2022 · 568b096 · 568b096
1 parent f6c8c7e
commit 568b096
Show file tree

Hide file tree

Showing 29 changed files with 29 additions and 1 deletion.
diff --git a/code-scanning/apisec-scan.yml b/code-scanning/apisec-scan.yml
@@ -49,6 +49,7 @@ jobs:
   Trigger APIsec scan:
     permissions:
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
 
     steps:

diff --git a/code-scanning/brakeman.yml b/code-scanning/brakeman.yml
@@ -25,6 +25,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     name: Brakeman Scan
     runs-on: ubuntu-latest
     steps:

diff --git a/code-scanning/checkmarx.yml b/code-scanning/checkmarx.yml
@@ -29,6 +29,7 @@ jobs:
       issues: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to github issues
       pull-requests: write # for checkmarx-ts/checkmarx-cxflow-github-action to write feedback to PR
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
 
     # Steps require - checkout code, run CxFlow Action, Upload SARIF report (optional)

diff --git a/code-scanning/clj-holmes.yml b/code-scanning/clj-holmes.yml
@@ -24,6 +24,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     steps:
       - name: Checkout code
         uses: actions/checkout@v2

diff --git a/code-scanning/clj-watson.yml b/code-scanning/clj-watson.yml
@@ -29,6 +29,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     steps:
       - name: Checkout code
         uses: actions/checkout@v2

diff --git a/code-scanning/codacy.yml b/code-scanning/codacy.yml
@@ -30,6 +30,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     name: Codacy Security Scan
     runs-on: ubuntu-latest
     steps:

diff --git a/code-scanning/codescan.yml b/code-scanning/codescan.yml
@@ -25,6 +25,7 @@ jobs:
         permissions:
           contents: read # for actions/checkout to fetch code
           security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+          actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
         runs-on: ubuntu-latest
         steps:
             -   name: Checkout repository

diff --git a/code-scanning/contrast-scan.yml b/code-scanning/contrast-scan.yml
@@ -30,6 +30,7 @@ jobs:
     permissions:
         contents: read # for actions/checkout
         security-events: write # for github/codeql-action/upload-sarif
+        actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
     # check out project
     steps:

diff --git a/code-scanning/eslint.yml b/code-scanning/eslint.yml
@@ -25,6 +25,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     steps:
       - name: Checkout code
         uses: actions/checkout@v3

diff --git a/code-scanning/hadolint.yml b/code-scanning/hadolint.yml
@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     steps:
       - name: Checkout code
         uses: actions/checkout@v3

diff --git a/code-scanning/lintr.yml b/code-scanning/lintr.yml
@@ -29,6 +29,7 @@ jobs:
     permissions:
       contents: read # for checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
 
     steps:
       - name: Checkout code

diff --git a/code-scanning/mobsf.yml b/code-scanning/mobsf.yml
@@ -21,6 +21,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
 
     steps:

diff --git a/code-scanning/msvc.yml b/code-scanning/msvc.yml
@@ -28,6 +28,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     name: Analyze
     runs-on: windows-latest
 

diff --git a/code-scanning/njsscan.yml b/code-scanning/njsscan.yml
@@ -25,6 +25,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
     name: njsscan code scanning
     steps:

diff --git a/code-scanning/ossar.yml b/code-scanning/ossar.yml
@@ -27,6 +27,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: windows-latest
 
     steps:

diff --git a/code-scanning/phpmd.yml b/code-scanning/phpmd.yml
@@ -34,6 +34,7 @@ jobs:
     permissions:
       contents: read # for checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
 
     steps:
       - name: Checkout code

diff --git a/code-scanning/pmd.yml b/code-scanning/pmd.yml
@@ -21,6 +21,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3

diff --git a/code-scanning/powershell.yml b/code-scanning/powershell.yml
@@ -25,6 +25,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     name: PSScriptAnalyzer
     runs-on: ubuntu-latest
     steps:

diff --git a/code-scanning/prisma.yml b/code-scanning/prisma.yml
@@ -29,6 +29,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
     name: Run Prisma Cloud IaC Scan to check
     steps:

diff --git a/code-scanning/puppet-lint.yml b/code-scanning/puppet-lint.yml
@@ -29,6 +29,7 @@ jobs:
     permissions:
       contents: read # for checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
 
     steps:
       - name: Checkout code

diff --git a/code-scanning/rust-clippy.yml b/code-scanning/rust-clippy.yml
@@ -25,6 +25,7 @@ jobs:
     permissions:
       contents: read
       security-events: write
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     steps:
       - name: Checkout code
         uses: actions/checkout@v2

diff --git a/code-scanning/semgrep.yml b/code-scanning/semgrep.yml
@@ -27,6 +27,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     name: Scan
     runs-on: ubuntu-latest
     steps:

diff --git a/code-scanning/snyk-container.yml b/code-scanning/snyk-container.yml
@@ -30,6 +30,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v3

diff --git a/code-scanning/snyk-infrastructure.yml b/code-scanning/snyk-infrastructure.yml
@@ -29,6 +29,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3

diff --git a/code-scanning/sobelow.yml b/code-scanning/sobelow.yml
@@ -28,6 +28,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
 
     steps:

diff --git a/code-scanning/sysdig-scan.yml b/code-scanning/sysdig-scan.yml
@@ -24,6 +24,7 @@ jobs:
       checks: write # for sysdiglabs/scan-action to publish the checks
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
 
     steps:

diff --git a/code-scanning/trivy.yml b/code-scanning/trivy.yml
@@ -22,6 +22,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     name: Build
     runs-on: "ubuntu-18.04"
     steps:

diff --git a/code-scanning/veracode.yml b/code-scanning/veracode.yml
@@ -27,6 +27,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
     steps:
 

diff --git a/code-scanning/xanitizer.yml b/code-scanning/xanitizer.yml
@@ -51,6 +51,7 @@ jobs:
     permissions:
       contents: read # for actions/checkout to fetch code
       security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status 
     runs-on: ubuntu-latest
 
     steps: