From 127c2bd08301ff5b81baecb4c1ddd6484c98561a Mon Sep 17 00:00:00 2001 From: Murilo Dal Ri Date: Thu, 11 Apr 2024 16:42:38 +0100 Subject: [PATCH] Add permissions to Brakeman job Adds permissions for Brakeman workflow to upload findings to GitHub Code Scanning within this repository. This will enhance visibility within GitHub UI, with findings displayed similarly to CodeQL. An example can be viewed [here](https://github.com/alphagov/support-api/pull/932). This PR will be reviewed and merged by the Platform Security and Reliability team. Any questions or concerns, please reach out in our channel: #govuk-platform-security-reliability-team. GOV.UK Infrastructure PR dependent on this: [Link](https://github.com/alphagov/govuk-infrastructure/pull/1238). [Trello card](https://trello.com/c/AFw2LOkY/3457-integrate-brakeman-findings-with-github-code-scanning-5) --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index bba5da6c..4158e427 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,6 +33,11 @@ jobs: security-analysis: name: Security Analysis uses: alphagov/govuk-infrastructure/.github/workflows/brakeman.yml@main + secrets: inherit + permissions: + contents: read + security-events: write + actions: read lint-ruby: name: Lint Ruby