Repository navigation
Specify default permissions for codeql-create-issues.yml #8580
Description
Activity
- moved this to New Issue Approval in P: HfLA Website: Project Board
on Mar 28, 2026 - moved this from New Issue Approval to Ready for Prioritization in P: HfLA Website: Project Board
on Apr 7, 2026 - moved this from Ready for Prioritization to Prioritized backlog in P: HfLA Website: Project Board
on Apr 28, 2026 - moved this from Prioritized backlog to In progress (actively working) in P: HfLA Website: Project Board
on May 27, 2026 Hi @castillios, thank you for taking up this issue! Hfla appreciates you :)
Do let fellow developers know about your:-
i. Availability: (When are you available to work on the issue/answer questions other programmers might have about your issue?)
ii. ETA: (When do you expect this issue to be completed?)You're awesome!
P.S. - You may not take up another issue until this issue gets merged (or closed). Thanks again :)
i. Availability: Weekdays before 7PM
ii. ETA: By Thursday 5/28 4PMI tried testing this workflow and noticed an error after implementing the
permissionsblock exactly as specified in the issue.
Testing and Error Logs for CodeQL Create Issues ActionI wanted to point attention to this part of the error log:
The nested job 'analyze' is requesting 'actions: read, security-events: write', but is only allowed 'actions: none, security-events: read'.It seems there are conflicting permissions here? In
codeql-scan-job.yml(whichcodeql-create-issues.ymluses) the permissions are correctly set toactions: read, security-events: writein its ownpermissionsblock.However I believe the top level permissions block this issue specifies for
codeql-create-issues.yml, overrides those settings which would otherwise be needed. Regardless when I ran the tests for this workflow BEFORE making these changesactionsandsecurity-eventswere both set tononeby default.Should I update the top-level permissions block to the following? Or if there's another issue at play, keep it as is?
permissions: actions: read contents: read security-events: write issues: readI used this google doc and this wiki article to set up my testing environment.
I'm still learning about GitHub Actions and would like some direction to resolving this issue. Thank you!Hi @castillios - yes, you are correct and can update the top-level permissions as shown, and in the PR you can note that you can state that the permissions were updated after we talked about it.
Thanks!
Reacted by Maleah SmithReacted by Maleah SmithHi @t-will-gillis, thank you for checking in! I've implemented the changes and opened a PR.
- moved this from In progress (actively working) to QA in P: HfLA Website: Project Board
on Jun 1, 2026
Prerequisites
Overview
We need to update the default permissions for the GitHub workflow specified in codeql-create-issues.yml, so that it does not have more permissions than it needs.
Details
To align with GitHub security best practices, we want to specify the minimum required permissions for each workflow via a top-level
permissions:block to ensure that workflows only have the access they need by default.Every GitHub Actions workflow automatically receives a
GITHUB_TOKENwith a set of default repository permissions defined in the repo settings which may result in the workflow having more permissions than it needs to complete its job. By explicitly defining minimum default permissions at the workflow level, we can ensure that workflow has only the permissions it needs. Then if a job or step requires more access, those permissions can be explicitly granted using job-level permissions statements or step-level tokens (PATs).We performed an audit to identify the minimum top-level permissions required for each workflow. The goal of this and related issues is to verify that each workflow continues to function correctly with the explicitly defined permissions. This approach helps minimize unnecessary privileges and strengthen overall repository security.
For additional info, see issue #8178 and GitHub's recommendation for security best practice.
Action Items
Note that this issue involves testing GitHub Actions. See "Resources/Instructions" below for how to set up your personal environment for testing.
Refer to codeql-create-issues.yml:
on:section.jobs:insert:Resources/Instructions