Conversation
IA-473 - Documentation - contributors
* IA-509: Formalise Docs * update changelog * Update CONTRIBUTING.md * commiit * Update MAINTAINERS.md * Update CHANGELOG.md --------- Co-authored-by: Conaill4 <conaill2004@outlook.com> Co-authored-by: Conaill O Neill <85241039+Conaill4@users.noreply.github.com>
…ts and pull requests (#16) Co-authored-by: peter.rooke <peter.rooke@defra.onmicrosoft.com>
github-actions
Bot
added
documentation
|
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+11
to
+124
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Fetch GitHub App token for target repo | ||
| id: target_token | ||
| uses: actions/create-github-app-token@v2 | ||
| with: | ||
| app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }} | ||
| private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }} | ||
| permission-contents: read | ||
|
|
||
| - name: Fetch GitHub App token for OSPO source repo (read-only) | ||
| id: ospo_token | ||
| uses: actions/create-github-app-token@v2 | ||
| with: | ||
| app-id: ${{ secrets.OSPO_WORKFLOW_APP_ID }} | ||
| private-key: ${{ secrets.OSPO_WORKFLOW_PRIVATE_KEY }} | ||
| owner: National-Digital-Twin | ||
| repositories: ospo-resources | ||
| permission-contents: read | ||
|
|
||
| - name: Checkout target repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| token: ${{ steps.target_token.outputs.token }} | ||
|
|
||
| - name: Checkout OSPO source repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: National-Digital-Twin/ospo-resources | ||
| path: ospo-resources | ||
| token: ${{ steps.ospo_token.outputs.token }} | ||
|
|
||
| - name: Checkout archetypes source repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: National-Digital-Twin/archetypes | ||
| path: archetypes | ||
|
|
||
| - name: Test for presence of OSS files and variation from templated content | ||
| run: | | ||
| missing_files=() | ||
| unchanged_files=() | ||
|
|
||
| while IFS= read -r file || [ -n "$file" ]; do | ||
| # Skip comments and empty lines | ||
| if [[ -z "$file" || "$file" == \#* ]]; then | ||
| continue | ||
| fi | ||
|
|
||
| target_path="$file" | ||
| archetypes_path="archetypes/$file" | ||
|
|
||
| if [ ! -f "$target_path" ]; then | ||
| echo "Missing OSS file in target repository: $target_path" | ||
| missing_files+=("$file") | ||
| elif cmp -s "$target_path" "$archetypes_path"; then | ||
| echo "OSS file unchanged from archetypes template: $target_path" | ||
| unchanged_files+=("$file") | ||
| else | ||
| echo "OSS file present and different from the archetypes template: $target_path" | ||
| fi | ||
| done < ospo-resources/oss-checklist-files.txt | ||
|
|
||
| echo "" | ||
| if [ ${#missing_files[@]} -ne 0 ]; then | ||
| echo "The following OSS required files are missing:" | ||
| printf '%s\n' "${missing_files[@]}" | ||
| fi | ||
|
|
||
| if [ ${#unchanged_files[@]} -ne 0 ]; then | ||
| echo "The following OSS required files are unchanged from the archetypes template:" | ||
| printf '%s\n' "${unchanged_files[@]}" | ||
| fi | ||
|
|
||
| if [ ${#missing_files[@]} -ne 0 ] || [ ${#unchanged_files[@]} -ne 0 ]; then | ||
| echo "OSS required file check failed." | ||
| exit 1 | ||
| else | ||
| echo "All OSS files are present and have been updated from their original templated content." | ||
| fi | ||
|
|
||
| - name: Check GitHub template files are present | ||
| run: | | ||
| echo "Checking for pull request and issue template files" | ||
|
|
||
| missing_templates=() | ||
|
|
||
| files_to_check=( | ||
| ".github/PULL_REQUEST_TEMPLATE.md" | ||
| ".github/ISSUE_TEMPLATE/bug_report.md" | ||
| ".github/ISSUE_TEMPLATE/feature_request.md" | ||
| ) | ||
|
|
||
| for file in "${files_to_check[@]}"; do | ||
| if [ ! -f "$file" ]; then | ||
| missing_templates+=("$file") | ||
| fi | ||
| done | ||
|
|
||
| if [ ${#missing_templates[@]} -ne 0 ]; then | ||
| echo "" | ||
| echo "Required GitHub template files not found:" | ||
| printf ' - %s\n' "${missing_templates[@]}" | ||
| echo "" | ||
| echo "These files help improve project collaboration and are considered best practice." | ||
| echo "These need to be included in repository contents to improve the developer and repository consumer experience." | ||
|
|
||
| # Fail the job | ||
| echo "Missing required GitHub template files." | ||
| exit 1 | ||
| else | ||
| echo "Required pull request and issue template files present." | ||
| fi |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the problem, you need to explicitly set the GITHUB_TOKEN permissions in this job. The best way to do this is to add a permissions: block at the root of the workflow or inside the oss-checks job to restrict permissions to the minimum required—which is contents: read for the tasks performed here. You can set it globally (root-level) or per-job; doing it job-level (inside oss-checks:) ensures least privilege even if other jobs are added later and need different permissions. No import or additional configuration is needed—just this addition in the right YAML block.
- Add a
permissions:key withcontents: readunder theoss-checks:job definition (i.e., at same indentation asruns-on:). - No other changes needed.
Suggested changeset
1
.github/workflows/oss-checker.yml
| @@ -8,6 +8,8 @@ | ||
|
|
||
| jobs: | ||
| oss-checks: | ||
| permissions: | ||
| contents: read | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: |
Copilot is powered by AI and may make mistakes. Always verify output.
cruddasj
added a commit
that referenced
this pull request
Aug 25, 2026
* Merge up latest updates to main (#24) * IA-473 Documentation - contributors (#13) IA-473 - Documentation - contributors * chore(deps): bump the python-packages group across 1 directory with 4 updates (#14) * IA-509: Formalise Docs (#15) * IA-509: Formalise Docs * update changelog * Update CONTRIBUTING.md * commiit * Update MAINTAINERS.md * Update CHANGELOG.md --------- Co-authored-by: Conaill4 <conaill2004@outlook.com> Co-authored-by: Conaill O Neill <85241039+Conaill4@users.noreply.github.com> * IA-524: Add markdown templates for bug report reports, feature requests and pull requests (#16) Co-authored-by: peter.rooke <peter.rooke@defra.onmicrosoft.com> * feature(OSPO): add inner-source licensing materials (#23) --------- Co-authored-by: athomas-kainos <ajith.thomas@kainos.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Harrison Duffield <46687573+HarrisonDuffield@users.noreply.github.com> Co-authored-by: Conaill4 <conaill2004@outlook.com> Co-authored-by: Conaill O Neill <85241039+Conaill4@users.noreply.github.com> Co-authored-by: Peter Rooke <peter.rooke@kainos.com> Co-authored-by: peter.rooke <peter.rooke@defra.onmicrosoft.com> * fix: update change log * fix: add SPDX headers and remove license variables --------- Co-authored-by: cruddasj <james.cruddas@informed.com> Co-authored-by: athomas-kainos <ajith.thomas@kainos.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Harrison Duffield <46687573+HarrisonDuffield@users.noreply.github.com> Co-authored-by: Conaill4 <conaill2004@outlook.com> Co-authored-by: Conaill O Neill <85241039+Conaill4@users.noreply.github.com> Co-authored-by: Peter Rooke <peter.rooke@kainos.com> Co-authored-by: peter.rooke <peter.rooke@defra.onmicrosoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge up latest updates to main