Conversation
| name: E2E Azure AKS | ||
| uses: ./.github/workflows/run-e2e-tests-on-operator.yaml | ||
| needs: [buildImage, azureAks] | ||
| with: | ||
| operator_type: aks | ||
| operator_image_version: ${{ needs.buildImage.outputs.image_tag }} | ||
| secrets: inherit |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
To fix the problem, explicitly declare permissions for the e2eAzureAks job so that the GITHUB_TOKEN does not default to potentially broad repository or organization settings. The minimal, behavior-preserving approach is to add permissions: {} to that job, which disables all default token permissions for this job and leaves any necessary scopes to be defined in the called reusable workflow (run-e2e-tests-on-operator.yaml).
Concretely, in .github/workflows/publish-azure-cc-enclave-docker.yaml, in the jobs: section where e2eAzureAks is defined (around lines 255–262), add a permissions: {} line alongside the other job-level keys (similar to the existing permissions: {} on azureCc and azureAks). The result will look like:
e2eAzureAks:
name: E2E Azure AKS
permissions: {}
uses: ./.github/workflows/run-e2e-tests-on-operator.yaml
needs: [buildImage, azureAks]
with:
operator_type: aks
operator_image_version: ${{ needs.buildImage.outputs.image_tag }}
secrets: inheritNo additional imports, methods, or definitions are required.
| @@ -254,6 +254,7 @@ | ||
|
|
||
| e2eAzureAks: | ||
| name: E2E Azure AKS | ||
| permissions: {} | ||
| uses: ./.github/workflows/run-e2e-tests-on-operator.yaml | ||
| needs: [buildImage, azureAks] | ||
| with: |
There was a problem hiding this comment.
maybe add
permissions:
contents: read
? Didn't spend time look into it want to make sure you have
| e2e-test: | ||
| name: E2E Test | ||
| uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-run-e2e-tests.yaml@v3 | ||
| uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-run-e2e-tests.yaml@kcc-UID2-6321-reenable-aks-e2e |
There was a problem hiding this comment.
Revert before merging
No description provided.