From ed688c1ef5b6a666bf00f0f35a0e0b8d8b35f5be Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Sun, 27 Sep 2026 02:52:50 -0300 Subject: [PATCH 1/2] fix: CodeQL "Workflow does not contain permissions" --- .github/workflows/clang-format.yml | 3 +++ .github/workflows/codeql.yml | 3 +++ .github/workflows/cpp-coverage.yml | 3 +++ .github/workflows/cpp-linux.yml | 3 +++ .github/workflows/cpp-macos.yml | 3 +++ .github/workflows/cpp-windows.yml | 3 +++ .github/workflows/cppcheck.yml | 4 +++- .github/workflows/docker-image.yml | 3 +++ .github/workflows/gitleaks.yml | 5 ++++- .github/workflows/make-coverage-html.yml | 3 +++ .github/workflows/prettier-json.yml | 3 +++ .github/workflows/sonarcloud.yml | 6 ++++-- .github/workflows/yamllint.yml | 3 +++ 13 files changed, 41 insertions(+), 4 deletions(-) diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml index dcf2edb..c28c710 100644 --- a/.github/workflows/clang-format.yml +++ b/.github/workflows/clang-format.yml @@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy branches: ["main"] workflow_dispatch: +permissions: + contents: read + jobs: lint: name: clang-format style check diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f6f23dd..11a05c9 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -31,6 +31,9 @@ on: # yamllint disable-line rule:truthy # * * * * * - cron: "16 20 * * 0" +permissions: + contents: read + jobs: analyze: name: Analyze (${{ matrix.language }}) diff --git a/.github/workflows/cpp-coverage.yml b/.github/workflows/cpp-coverage.yml index aef782c..16ad002 100644 --- a/.github/workflows/cpp-coverage.yml +++ b/.github/workflows/cpp-coverage.yml @@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy branches: ["main"] workflow_dispatch: +permissions: + contents: read + jobs: coverage: name: C/C++ CMake CI Coverage diff --git a/.github/workflows/cpp-linux.yml b/.github/workflows/cpp-linux.yml index cbcf20f..9d3687b 100644 --- a/.github/workflows/cpp-linux.yml +++ b/.github/workflows/cpp-linux.yml @@ -12,6 +12,9 @@ on: # yamllint disable-line rule:truthy env: VCPKG_VERSION: 2026.07.29 +permissions: + contents: read + jobs: test: name: C/C++ CMake CI Test diff --git a/.github/workflows/cpp-macos.yml b/.github/workflows/cpp-macos.yml index 6773ef5..3b2f619 100644 --- a/.github/workflows/cpp-macos.yml +++ b/.github/workflows/cpp-macos.yml @@ -12,6 +12,9 @@ on: # yamllint disable-line rule:truthy env: VCPKG_VERSION: 2026.07.29 +permissions: + contents: read + jobs: test: name: C/C++ CMake CI Test diff --git a/.github/workflows/cpp-windows.yml b/.github/workflows/cpp-windows.yml index 1504215..32ec6d7 100644 --- a/.github/workflows/cpp-windows.yml +++ b/.github/workflows/cpp-windows.yml @@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy branches: ["main"] workflow_dispatch: +permissions: + contents: read + jobs: test: name: C/C++ CMake CI Test diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml index f525d35..b5ac1a3 100644 --- a/.github/workflows/cppcheck.yml +++ b/.github/workflows/cppcheck.yml @@ -1,5 +1,4 @@ --- - name: CppCheck Lint on: # yamllint disable-line rule:truthy @@ -10,6 +9,9 @@ on: # yamllint disable-line rule:truthy branches: ["main"] workflow_dispatch: +permissions: + contents: read + jobs: lint: name: CppCheck Lint diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml index 1c35bd5..fa78cb8 100644 --- a/.github/workflows/docker-image.yml +++ b/.github/workflows/docker-image.yml @@ -13,6 +13,9 @@ env: IMAGE_NAME: algorithm-exercises-cpp ARTIFACT_NAME: algorithm-exercises-cpp_${{ github.sha }} +permissions: + contents: read + jobs: setup: name: "Setup matrix" diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml index b55aa4b..aaf14b1 100644 --- a/.github/workflows/gitleaks.yml +++ b/.github/workflows/gitleaks.yml @@ -1,5 +1,4 @@ --- - name: gitleaks on: # yamllint disable-line rule:truthy @@ -17,6 +16,10 @@ on: # yamllint disable-line rule:truthy # │ │ │ │ │ # * * * * * - cron: "0 6 * * *" # run once a day at 6 AM + +permissions: + contents: read + jobs: scan: name: gitleaks diff --git a/.github/workflows/make-coverage-html.yml b/.github/workflows/make-coverage-html.yml index 3d7f4fa..34b23ba 100644 --- a/.github/workflows/make-coverage-html.yml +++ b/.github/workflows/make-coverage-html.yml @@ -12,6 +12,9 @@ on: # yamllint disable-line rule:truthy branches: ["main"] workflow_dispatch: +permissions: + contents: read + jobs: make-coverage-html: name: "Run make coverage/html and verify coverage HTML" diff --git a/.github/workflows/prettier-json.yml b/.github/workflows/prettier-json.yml index ae39f1e..ff9a522 100644 --- a/.github/workflows/prettier-json.yml +++ b/.github/workflows/prettier-json.yml @@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy branches: ["main"] workflow_dispatch: +permissions: + contents: read + jobs: json-lint: name: "Prettier JSON Lint" diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 826a42b..976dadc 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -8,6 +8,9 @@ on: # yamllint disable-line rule:truthy types: [opened, synchronize, reopened] workflow_dispatch: +permissions: + contents: read + jobs: build: name: SonarCloud build and run sonar-scanner @@ -23,8 +26,7 @@ jobs: - name: Install Tools run: | sudo rm /usr/lib/python3.*/EXTERNALLY-MANAGED - pip install gcovr - # + pip install --only-binary :all: gcovr==8.6 # Install lcov dependencies sudo apt-get install libcapture-tiny-perl libdatetime-perl # Install lcov from source diff --git a/.github/workflows/yamllint.yml b/.github/workflows/yamllint.yml index 4a0304c..18a9be0 100644 --- a/.github/workflows/yamllint.yml +++ b/.github/workflows/yamllint.yml @@ -9,6 +9,9 @@ on: # yamllint disable-line rule:truthy branches: ["main"] workflow_dispatch: +permissions: + contents: read + jobs: lint: name: YAML lint From 739111b0611fb2c21f02ae44755c3c46351a8df0 Mon Sep 17 00:00:00 2001 From: Gonzalo Diaz Date: Sun, 27 Sep 2026 02:56:15 -0300 Subject: [PATCH 2/2] fix: [BUGFIX] sonarcloud "Using dependencies without locking resolved versions is security-sensitive.sonarqube(githubactions:S8544)" --- .github/workflows/sonarcloud.yml | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index 976dadc..5d7465e 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -25,16 +25,9 @@ jobs: fetch-depth: 0 - name: Install Tools run: | + sudo apt-get install lcov sudo rm /usr/lib/python3.*/EXTERNALLY-MANAGED pip install --only-binary :all: gcovr==8.6 - # Install lcov dependencies - sudo apt-get install libcapture-tiny-perl libdatetime-perl - # Install lcov from source - git clone https://github.com/linux-test-project/lcov.git - cd lcov - git checkout v2.3.2 - sudo make install - cd .. - name: Check Tools run: |