Skip to content

Conversation

jesmrec
Copy link
Collaborator

@jesmrec jesmrec commented Sep 1, 2025

Internal code scanning returned the following issue (medium severity):

https://github.com/owncloud/android/security/code-scanning/7

as explanation:

If a GitHub Actions job or workflow has no explicit permissions set, then the repository permissions are used. Repositories created under organizations inherit the organization permissions. The organizations or repositories created before February 2023 have the default permissions set to read-write. Often these permissions do not adhere to the principle of least privilege and can be reduced to read-only, leaving the write permission only to a specific types as issues: write or pull-requests: write.

Fixed by adding the permissions: block with just read permission to the detekt workflow, avoiding the default write pemission.

Related Issues

App: https://github.com/owncloud/android/security/code-scanning/7

  • Add changelog files for the fixed issues in folder changelog/unreleased. More info here
  • Add feature to Release Notes in ReleaseNotesViewModel.kt creating a new ReleaseNote() with String resources (if required)

QA

@jesmrec jesmrec self-assigned this Sep 1, 2025
@jesmrec jesmrec added this to the 4.7 - Current milestone Sep 1, 2025
@jesmrec jesmrec force-pushed the fix/add_permission_detekt_workflow branch from 8b3ba86 to fa2bb61 Compare September 1, 2025 11:54
@jesmrec jesmrec closed this Sep 1, 2025
@jesmrec jesmrec reopened this Sep 1, 2025
@jesmrec jesmrec force-pushed the fix/add_permission_detekt_workflow branch from fa2bb61 to c63a8d5 Compare September 1, 2025 12:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants