Skip to content

Conversation

@jesmrec
Copy link
Collaborator

@jesmrec jesmrec commented Sep 1, 2025

Internal code scanning returned the following issue (medium severity):

https://github.com/owncloud/android/security/code-scanning/7

as explanation:

If a GitHub Actions job or workflow has no explicit permissions set, then the repository permissions are used. Repositories created under organizations inherit the organization permissions. The organizations or repositories created before February 2023 have the default permissions set to read-write. Often these permissions do not adhere to the principle of least privilege and can be reduced to read-only, leaving the write permission only to a specific types as issues: write or pull-requests: write.

Fixed by adding the permissions: block with just read permission to the detekt workflow, avoiding the default write pemission.

Related Issues

App: https://github.com/owncloud/android/security/code-scanning/7

  • Add changelog files for the fixed issues in folder changelog/unreleased. More info here
  • Add feature to Release Notes in ReleaseNotesViewModel.kt creating a new ReleaseNote() with String resources (if required)

QA

@jesmrec jesmrec self-assigned this Sep 1, 2025
@jesmrec jesmrec added this to the 4.7 - Current milestone Sep 1, 2025
@jesmrec jesmrec force-pushed the fix/add_permission_detekt_workflow branch from 8b3ba86 to fa2bb61 Compare September 1, 2025 11:54
@jesmrec jesmrec closed this Sep 1, 2025
@jesmrec jesmrec reopened this Sep 1, 2025
@jesmrec jesmrec force-pushed the fix/add_permission_detekt_workflow branch from fa2bb61 to c63a8d5 Compare September 1, 2025 12:43
@jesmrec jesmrec requested a review from joragua September 9, 2025 06:41
@jesmrec jesmrec marked this pull request as ready for review September 9, 2025 06:41
Copy link
Collaborator

@joragua joragua left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! 💯

@jesmrec jesmrec merged commit 2b936cc into master Sep 9, 2025
13 checks passed
@jesmrec jesmrec deleted the fix/add_permission_detekt_workflow branch September 9, 2025 08:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants