Develop->Master

[bio-boris]

No description provided.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

To fix the problem, add a permissions block to the workflow file to explicitly set the minimum required permissions for the GITHUB_TOKEN. Since the workflow does not appear to require any write access to repository contents or other resources (it only checks out code, runs tests, and uploads artifacts), the minimal required permission is likely contents: read. This block should be added at the top level of the workflow (just after the name: and before on:), so it applies to all jobs unless overridden. No changes to the jobs or steps are required.

Steps:

• Edit .github/workflows/basic_sdk_functionality_tests.yml.
• Insert the following block after the name: line and before the on: block:

  permissions:
    contents: read

• No additional imports, methods, or definitions are needed.

---

To fix the problem, add a permissions block to the workflow file. The best way is to add it at the root level (just below the name: and before on:), so it applies to all jobs unless overridden. For this workflow, the jobs only need to read repository contents and upload artifacts, so the minimal permissions should be contents: read. If any job requires additional permissions (e.g., to write to issues or pull requests), those can be added at the job level, but in this case, none of the jobs appear to require such permissions. The change should be made at the top of .github/workflows/basic_sdk_functionality_tests.yml, adding the following block:

permissions:
  contents: read

No additional imports, methods, or definitions are required.

To fix the problem, explicitly set the permissions block in the workflow file. The best practice is to set it at the top level of the workflow, so it applies to all jobs unless overridden. Since the workflow appears to only build and push (likely to a container registry or similar), the minimal required permissions are probably contents: read (to read the repository contents). If the workflow or the reusable workflow needs to push to a registry or create releases, additional permissions may be needed, but as a safe default, contents: read is recommended. The change should be made by adding a permissions: block after the name: field and before the on: field in .github/workflows/manual-build.yml.

To fix the problem, add a permissions block at the top level of the workflow file, immediately after the name key and before the on key. This block should specify the minimal permissions required for the workflow to function. As a starting point, set contents: read, which is the most restrictive and safest default. If any jobs or reusable workflows require additional permissions (such as pull-requests: write), those can be added as needed, but in the absence of such requirements in the provided snippet, contents: read is appropriate. No changes to the jobs themselves are necessary unless more granular permissions are required for specific jobs.

---

To fix the problem, add a permissions block at the top level of the workflow file, just below the name field and before the on field. This block should specify the minimum permissions required for the workflow to function. Since the jobs in this workflow only invoke reusable workflows and do not appear to require write access, the safest minimal starting point is contents: read. If any job or reusable workflow requires additional permissions, those can be added as needed. The change should be made at the top of .github/workflows/pr_build.yml, and no additional imports or definitions are required.

---

To fix the problem, add a permissions block to the workflow file .github/workflows/pr_build.yml. The best practice is to set this at the top level, so all jobs inherit the least privilege by default. If any job requires additional permissions, you can override the block at the job level. As a minimal starting point, set contents: read, which is sufficient for most workflows that only need to check out code or read repository contents. If any job needs to write to pull requests or other resources, you can add those permissions as needed.

Steps:

• Add a permissions: block after the name: key and before the on: key (i.e., after line 2).
• Set contents: read as the minimal permission.
• If you know that some jobs require more (e.g., pull-requests: write), you can add those, but the minimal fix is to set contents: read.

---

To fix the problem, add a permissions block at the top level of the workflow (just after the name: key and before on:). This block should specify the minimal permissions required for the workflow to function. As a starting point, set contents: read, which is the most restrictive and safest default. If any jobs require additional permissions (e.g., to write to pull requests), those can be added as needed. Since the jobs here only call reusable workflows, and without further information, the safest fix is to set contents: read at the workflow level. This will apply to all jobs unless overridden.

To fix the problem, add a permissions block to the root of the workflow file .github/workflows/release-main.yml. This block should specify the minimal set of permissions required for the workflow to function. Since the workflow is triggered by a release and appears to build and push images, it likely needs at least contents: read to access repository contents, and possibly packages: write or similar if it pushes to a package registry. As a minimal starting point, set contents: read. If further permissions are required (e.g., for pushing to packages or updating pull requests), they can be added as needed. The change should be made at the top level of the YAML file, immediately after the name: field and before the on: field.

To fix the problem, add a permissions block at the top level of the workflow file, immediately after the name: field and before the on: field. This block should specify the minimal permissions required for the workflow to function. Since the jobs in this workflow only call reusable workflows and do not appear to require write access themselves, the safest minimal starting point is contents: read. If any of the called reusable workflows require additional permissions, those can be added as needed, but starting with contents: read is the recommended baseline.

Steps:

• Edit .github/workflows/release-main.yml.
• Insert a permissions: block after the name: field (line 2), before the on: field (line 3).
• Set contents: read as the minimal permission.

---

To fix the problem, you should add a permissions block to the workflow, either at the root level (to apply to all jobs) or to individual jobs as needed. The block should specify the minimal set of permissions required for the workflow to function. Since this workflow is triggered by a release event and appears to build and push images, it likely needs at least contents: read (to read repository contents) and possibly packages: write or actions: write if it interacts with packages or actions. As a minimal starting point, you should add permissions: contents: read at the root level, and then adjust as needed if you know the workflow requires more. The change should be made at the top of the file, after the name: block and before on:.