Add Firewall QA Tests #291
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| test_php_qa_action: | ||
| runs-on: ubuntu-latest | ||
| needs: [ build_deb ] | ||
| steps: | ||
|
|
||
| - name: Checkout zen-demo-php | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: Aikido-demo-apps/zen-demo-php | ||
| path: zen-demo-php | ||
| ref: dev-testing | ||
| submodules: recursive | ||
|
|
||
| - name: Get Arch | ||
| run: echo "ARCH=$(uname -m)" >> $GITHUB_ENV | ||
|
|
||
| - name: Download artifacts | ||
| uses: actions/download-artifact@v4 | ||
| with: | ||
| name: aikido-php-firewall.${{ env.ARCH }}.deb | ||
| path: ./zen-demo-php | ||
|
|
||
| - name: Overwrite aikido.sh install script | ||
| run: | | ||
| echo "dpkg -i -E \"/var/www/html/aikido-php-firewall.\$(uname -i).deb\"" > ./zen-demo-php/.fly/scripts/aikido.sh | ||
| - name: Run Firewall QA Tests | ||
| uses: AikidoSec/firewall-tester-action@releases/v1 | ||
| with: | ||
| dockerfile_path: ./zen-demo-php/Dockerfile | ||
| extra_args: '--env-file=./zen-demo-php/.env.example -e APP_KEY=base64:W2v6u6VR4lURkxuMT9xZ6pdhXSt5rxsmWTbd1HGqlIM=' | ||
| sleep_before_test: 20 | ||
| skip_tests: test_wave_attack,test_rate_limiting_group_id_1_minute | ||
| max_parallel_tests: 7 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 10 days ago
The correct way to fix this issue is to add an explicit permissions block specifying the minimal set of permissions required. In this case, since none of the jobs require write access to repository contents or metadata, the safest starting point is permissions: contents: read, applied at the root level—this ensures all jobs default to least privilege. If individual jobs require more privileges, a granular permissions block can be added to those jobs only. To implement the fix, insert permissions: contents: read beneath the workflow name (line 1) and above on: (line 3) in .github/workflows/build.yml.
No new imports or packages are required; this fix is declarative in the workflow YAML.
| @@ -1,4 +1,6 @@ | ||
| name: Build | ||
| permissions: | ||
| contents: read | ||
|
|
||
| on: | ||
| push: |
1 participant
No description provided.