Create Jenkins.cbci for CL CBCI onboarding#16308
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| runs-on: self-hosted | ||
| env: | ||
| REPO_NAME: ${{ github.event.repository.name }} | ||
| ORG_NAME: ${{ github.event.organization.login }} | ||
| JENKINS_ROOT: ${{ secrets.JENKINS_CONTROLLER_URL }}job/${{ secrets.JENKINS_TRIGGER_ROOT_FOLDER }}/job/${{ secrets.JENKINS_TRIGGER_ORG_FOLDER }}/job/ | ||
| steps: | ||
| - name: trigger single Job | ||
| run: > | ||
| curl -X POST -u "${{ secrets.JENKINS_TRIGGER_USER }}:${{ secrets.JENKINS_TRIGGER_TOKEN }}" | ||
| ${{ env.JENKINS_ROOT}}/${{ env.ORG_NAME }}/job/${{ env.REPO_NAME }}/build\?delay=\0 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 year ago
To fix the issue, we will add a permissions block at the root level of the workflow. This block will explicitly define the least privileges required for the workflow. Since the workflow only triggers a Jenkins job and does not interact with the repository contents, we will set contents: read as the minimal permission. This ensures that the workflow has read-only access to the repository contents and no write access.
The changes will be made to the .github/workflows/trigger_jenkins.yaml file. No additional methods, imports, or definitions are required.
| @@ -1,2 +1,4 @@ | ||
| name: Trigger Jenkins CI | ||
| permissions: | ||
| contents: read | ||
| on: |
3 participants
Purpose
CL CBCI onboarding configuration - localization
(FILL ME IN) This section describes why this PR is here. Usually it would include a reference to the tracking task that it is part or all of the solution for.
Declarations
Check these if you believe they are true
*.resxfilesRelease Notes
(FILL ME IN) Brief description of the fix / enhancement. Use N/A to indicate that the changes in this pull request do not apply to Release Notes. Mandatory section
Reviewers
(FILL ME IN) Reviewer 1 (If possible, assign the Reviewer for the PR)
(FILL ME IN, optional) Any additional notes to reviewers or testers.
FYIs
(FILL ME IN, Optional) Names of anyone else you wish to be notified of