From e96d32a02f831920e1ee64b6b954ddbf78138a86 Mon Sep 17 00:00:00 2001 From: Murilo Dal Ri Date: Thu, 11 Apr 2024 16:38:00 +0100 Subject: [PATCH] Add permissions to Brakeman job Adds permissions for Brakeman workflow to upload findings to GitHub Code Scanning within this repository. This will enhance visibility within GitHub UI, with findings displayed similarly to CodeQL. An example can be viewed [here](https://github.com/alphagov/support-api/pull/932). This PR will be reviewed and merged by the Platform Security and Reliability team. Any questions or concerns, please reach out in our channel: #govuk-platform-security-reliability-team. GOV.UK Infrastructure PR dependent on this: [Link](https://github.com/alphagov/govuk-infrastructure/pull/1238). [Trello card](https://trello.com/c/AFw2LOkY/3457-integrate-brakeman-findings-with-github-code-scanning-5) --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c51ed62f..f62c62a3 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,6 +33,11 @@ jobs: security-analysis: name: Security Analysis uses: alphagov/govuk-infrastructure/.github/workflows/brakeman.yml@main + secrets: inherit + permissions: + contents: read + security-events: write + actions: read lint-scss: name: Lint SCSS