Feature/ab#2043 helm chart #4
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: "Check if Helm chart is correct" | ||
| needs: build | ||
| runs-on: [self-hosted, linux, X64] | ||
|
|
||
| steps: | ||
| - name: get helm | ||
| uses: azure/setup-helm@v4 | ||
|
|
||
| - name: run helm dependency update | ||
| working-directory: target/helm/dave-backend | ||
| run: helm dep update | ||
|
|
||
| - name: run helm template | ||
| working-directory: target/helm | ||
| run: helm template dave-backend |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 days ago
To fix the issue, add an explicit permissions block to the check_helm job to constrain the default GITHUB_TOKEN permissions. Since the check_helm job only installs Helm and runs commands against files produced by earlier steps, it doesn’t need to interact with the GitHub API, so we can set permissions: {} (no permissions) for that job. This leaves the existing compliance and build jobs unchanged.
Concretely, in .github/workflows/pr_build.yaml, locate the check_helm job definition starting at line 63. Insert a permissions: {} block under the existing needs: build (or runs-on) key, with proper indentation to match other jobs. No imports or additional definitions are needed, as this is purely a YAML configuration change for the workflow.
| @@ -64,6 +64,7 @@ | ||
| name: "Check if Helm chart is correct" | ||
| needs: build | ||
| runs-on: [self-hosted, linux, X64] | ||
| permissions: {} | ||
|
|
||
| steps: | ||
| - name: get helm |
Description
Adds a Helm chart to deploy Dave Backend.