Conversation
There was a problem hiding this comment.
Pull request overview
Tightens GitHub Actions security posture by reducing inherited secrets and explicitly scoping permissions/secrets for reusable workflow calls.
Changes:
- Replace
secrets: inheritwith an explicitSLACK_BOT_TOKENsecret mapping in the deploy notification jobs. - Add explicit
permissionsblocks to reusable workflow jobs (CodeQL scan, PR verification). - Add a PR-author association gate to the CodeQL reusable workflow job.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| .github/workflows/deploy-main.yml | Stops inheriting all secrets for Slack notification reusable workflow; passes only Slack token. |
| .github/workflows/codeql.yml | Adds job permissions and a PR author-association gate for the CodeQL reusable workflow. |
| .github/workflows/branch-verify.yml | Adds minimal contents: read permissions for the PR verification reusable workflow job. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
…er into tighterGithubActions
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
No description provided.