-
-
Notifications
You must be signed in to change notification settings - Fork 1
vast #3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: java
Are you sure you want to change the base?
vast #3
Changes from all commits
c5e30e7
d269d95
31185d2
556b4f0
7ec96d0
11d03ae
4fdc96b
fec17c6
4272c56
e7730ef
11bfbe4
1203abb
3f0348a
6b1c050
e593260
c6b1514
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| # To get started with Dependabot version updates, you'll need to specify which | ||
| # package ecosystems to update and where the package manifests are located. | ||
| # Please see the documentation for all configuration options: | ||
| # https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file | ||
|
|
||
| version: 2 | ||
| updates: | ||
| # Налаштування для оновлення GitHub Actions | ||
| - package-ecosystem: "github-actions" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
|
|
||
|
|
||
|
|
||
|
|
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| name: Android CI | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| pull_request: | ||
| branches: [ "main" ] | ||
|
|
||
| jobs: | ||
| build: | ||
|
|
||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: set up JDK 11 | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| java-version: '11' | ||
| distribution: 'temurin' | ||
| cache: gradle | ||
|
|
||
| - name: Grant execute permission for gradlew | ||
| run: chmod +x gradlew | ||
| - name: Build with Gradle | ||
| run: ./gradlew build | ||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,65 @@ | ||||||||||||||||||||||||||||||||
| # This workflow will build a Java project and deploy it to an Azure Functions App on Windows or Linux when a commit is pushed to your default branch. | ||||||||||||||||||||||||||||||||
| # | ||||||||||||||||||||||||||||||||
| # This workflow assumes you have already created the target Azure Functions app. | ||||||||||||||||||||||||||||||||
| # For instructions see https://learn.microsoft.com/en-us/azure/azure-functions/create-first-function-vs-code-java | ||||||||||||||||||||||||||||||||
| # | ||||||||||||||||||||||||||||||||
| # To configure this workflow: | ||||||||||||||||||||||||||||||||
| # 1. Set up the following secrets in your repository: | ||||||||||||||||||||||||||||||||
| # - AZURE_FUNCTIONAPP_PUBLISH_PROFILE | ||||||||||||||||||||||||||||||||
| # 2. Change env variables for your configuration. | ||||||||||||||||||||||||||||||||
| # | ||||||||||||||||||||||||||||||||
| # For more information on: | ||||||||||||||||||||||||||||||||
| # - GitHub Actions for Azure: https://github.com/Azure/Actions | ||||||||||||||||||||||||||||||||
| # - Azure Functions Action: https://github.com/Azure/functions-action | ||||||||||||||||||||||||||||||||
| # - Publish Profile: https://github.com/Azure/functions-action#using-publish-profile-as-deployment-credential-recommended | ||||||||||||||||||||||||||||||||
| # - Azure Service Principal for RBAC: https://github.com/Azure/functions-action#using-azure-service-principal-for-rbac-as-deployment-credential | ||||||||||||||||||||||||||||||||
| # | ||||||||||||||||||||||||||||||||
| # For more samples to get started with GitHub Action workflows to deploy to Azure: https://github.com/Azure/actions-workflow-samples/tree/master/FunctionApp | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| name: Deploy Java project to Azure Function App | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||
| push: | ||||||||||||||||||||||||||||||||
| branches: ["main"] | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| env: | ||||||||||||||||||||||||||||||||
| AZURE_FUNCTIONAPP_NAME: 'your-app-name' # set this to your function app name on Azure | ||||||||||||||||||||||||||||||||
| POM_XML_DIRECTORY: '.' # set this to the directory which contains pom.xml file | ||||||||||||||||||||||||||||||||
| DISTRIBUTION: 'zulu' # set this to the java version to use (e.g. 'zulu', 'temurin', 'microsoft') | ||||||||||||||||||||||||||||||||
| JAVA_VERSION: '8' # set this to the java version to use (e.g. '8', '11', '17') | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||
| build-and-deploy: | ||||||||||||||||||||||||||||||||
| runs-on: windows-latest # For Linux, use ubuntu-latest | ||||||||||||||||||||||||||||||||
| environment: dev | ||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||
| - name: 'Checkout GitHub Action' | ||||||||||||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| # If you want to use Azure RBAC instead of Publish Profile, then uncomment the task below | ||||||||||||||||||||||||||||||||
| # - name: 'Login via Azure CLI' | ||||||||||||||||||||||||||||||||
| # uses: azure/login@v1 | ||||||||||||||||||||||||||||||||
| # with: | ||||||||||||||||||||||||||||||||
| # creds: ${{ secrets.AZURE_RBAC_CREDENTIALS }} # set up AZURE_RBAC_CREDENTIALS secrets in your repository | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: Setup Java Sdk ${{ env.JAVA_VERSION }} | ||||||||||||||||||||||||||||||||
| uses: actions/setup-java@v4 | ||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||
| distribution: ${{ env.DISTRIBUTION }} | ||||||||||||||||||||||||||||||||
| java-version: ${{ env.JAVA_VERSION }} | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: 'Restore Project Dependencies Using Mvn' | ||||||||||||||||||||||||||||||||
| shell: pwsh # For Linux, use bash | ||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||
| pushd './${{ env.POM_XML_DIRECTORY }}' | ||||||||||||||||||||||||||||||||
| mvn clean package | ||||||||||||||||||||||||||||||||
| popd | ||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||
| - name: 'Run Azure Functions Action' | ||||||||||||||||||||||||||||||||
| uses: Azure/functions-action@v1 | ||||||||||||||||||||||||||||||||
| id: fa | ||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||
| app-name: ${{ env.AZURE_FUNCTIONAPP_NAME }} | ||||||||||||||||||||||||||||||||
| package: '${{ env.POM_XML_DIRECTORY }}' # if there are multiple function apps in same project, then this path will be like './${{ env.POM_XML_DIRECTORY }}/target/azure-functions/${{ env.POM_FUNCTIONAPP_NAME }' | ||||||||||||||||||||||||||||||||
| publish-profile: ${{ secrets.AZURE_FUNCTIONAPP_PUBLISH_PROFILE }} # Remove publish-profile to use Azure RBAC | ||||||||||||||||||||||||||||||||
| respect-pom-xml: true | ||||||||||||||||||||||||||||||||
|
Comment on lines
+33
to
+65
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Copilot AutofixAI about 8 hours ago In general, the fix is to explicitly declare a The single best fix with no behavioral change is to add a root‑level permissions:
contents: readafter line 19 (
Suggested changeset
1
.github/workflows/azure-functions-app-java.yml
Copilot is powered by AI and may make mistakes. Always verify output.
Refresh and try again.
|
||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,101 @@ | ||
| # For most projects, this workflow file will not need changing; you simply need | ||
| # to commit it to your repository. | ||
| # | ||
| # You may wish to alter this file to override the set of languages analyzed, | ||
| # or to provide custom queries or build logic. | ||
| # | ||
| # ******** NOTE ******** | ||
| # We have attempted to detect the languages in your repository. Please check | ||
| # the `language` matrix defined below to confirm you have the correct set of | ||
| # supported CodeQL languages. | ||
| # | ||
| name: "CodeQL Advanced" | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| pull_request: | ||
| branches: [ "main" ] | ||
| schedule: | ||
| - cron: '34 17 * * 2' | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze (${{ matrix.language }}) | ||
| # Runner size impacts CodeQL analysis time. To learn more, please see: | ||
| # - https://gh.io/recommended-hardware-resources-for-running-codeql | ||
| # - https://gh.io/supported-runners-and-hardware-resources | ||
| # - https://gh.io/using-larger-runners (GitHub.com only) | ||
| # Consider using larger runners or machines with greater resources for possible analysis time improvements. | ||
| runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }} | ||
| permissions: | ||
| # required for all workflows | ||
| security-events: write | ||
|
|
||
| # required to fetch internal or private CodeQL packs | ||
| packages: read | ||
|
|
||
| # only required for workflows in private repositories | ||
| actions: read | ||
| contents: read | ||
|
|
||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| include: | ||
| - language: actions | ||
| build-mode: none | ||
| - language: java-kotlin | ||
| build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too. | ||
| # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift' | ||
| # Use `c-cpp` to analyze code written in C, C++ or both | ||
| # Use 'java-kotlin' to analyze code written in Java, Kotlin or both | ||
| # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both | ||
| # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis, | ||
| # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning. | ||
| # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how | ||
| # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| # Add any setup steps before running the `github/codeql-action/init` action. | ||
| # This includes steps like installing compilers or runtimes (`actions/setup-node` | ||
| # or others). This is typically only required for manual builds. | ||
| # - name: Setup runtime (example) | ||
| # uses: actions/setup-example@v1 | ||
|
|
||
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v4 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| build-mode: ${{ matrix.build-mode }} | ||
| # If you wish to specify custom queries, you can do so here or in a config file. | ||
| # By default, queries listed here will override any specified in a config file. | ||
| # Prefix the list here with "+" to use these queries and those in the config file. | ||
|
|
||
| # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs | ||
| # queries: security-extended,security-and-quality | ||
|
|
||
| # If the analyze step fails for one of the languages you are analyzing with | ||
| # "We were unable to automatically build your code", modify the matrix above | ||
| # to set the build mode to "manual" for that language. Then modify this step | ||
| # to build your code. | ||
| # ℹ️ Command-line programs to run using the OS shell. | ||
| # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun | ||
| - name: Run manual build steps | ||
| if: matrix.build-mode == 'manual' | ||
| shell: bash | ||
| run: | | ||
| echo 'If you are using a "manual" build mode for one or more of the' \ | ||
| 'languages you are analyzing, replace this with the commands to build' \ | ||
| 'your code, for example:' | ||
| echo ' make bootstrap' | ||
| echo ' make release' | ||
| exit 1 | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v4 | ||
| with: | ||
| category: "/language:${{matrix.language}}" |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # This workflow uses actions that are not certified by GitHub. | ||
| # They are provided by a third-party and are governed by | ||
| # separate terms of service, privacy policy, and support | ||
| # documentation. | ||
| # This workflow will build a package using Gradle and then publish it to GitHub packages when a release is created | ||
| # For more information see: https://github.com/actions/setup-java/blob/main/docs/advanced-usage.md#Publishing-using-gradle | ||
|
|
||
| name: Gradle Package | ||
|
|
||
| on: | ||
| release: | ||
| types: [created] | ||
|
|
||
| jobs: | ||
| build: | ||
|
|
||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up JDK 17 | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| java-version: '17' | ||
| distribution: 'temurin' | ||
| server-id: github # Value of the distributionManagement/repository/id field of the pom.xml | ||
| settings-path: ${{ github.workspace }} # location for the settings.xml file | ||
|
|
||
| - name: Setup Gradle | ||
| uses: gradle/actions/setup-gradle@af1da67850ed9a4cedd57bfd976089dd991e2582 # v4.0.0 | ||
|
|
||
| - name: Build with Gradle | ||
| run: ./gradlew build | ||
|
|
||
| # The USERNAME and TOKEN need to correspond to the credentials environment variables used in | ||
| # the publishing section of your build.gradle | ||
| - name: Publish to GitHub Packages | ||
| run: ./gradlew publish | ||
| env: | ||
| USERNAME: ${{ github.actor }} | ||
| TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| # This workflow uses actions that are not certified by GitHub. | ||
| # They are provided by a third-party and are governed by | ||
| # separate terms of service, privacy policy, and support | ||
| # documentation. | ||
| # | ||
| # Find more information at: | ||
| # https://github.com/microsoft/msvc-code-analysis-action | ||
|
|
||
| name: Microsoft C++ Code Analysis | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| pull_request: | ||
| branches: [ "main" ] | ||
| schedule: | ||
| - cron: '18 2 * * 4' | ||
|
|
||
| env: | ||
| # Path to the CMake build directory. | ||
| build: '${{ github.workspace }}/build' | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| analyze: | ||
| permissions: | ||
| contents: read # for actions/checkout to fetch code | ||
| security-events: write # for github/codeql-action/upload-sarif to upload SARIF results | ||
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | ||
| name: Analyze | ||
| runs-on: windows-latest | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Configure CMake | ||
| run: cmake -B ${{ env.build }} | ||
|
|
||
| # Build is not required unless generated source files are used | ||
| # - name: Build CMake | ||
| # run: cmake --build ${{ env.build }} | ||
|
|
||
| - name: Initialize MSVC Code Analysis | ||
| uses: microsoft/msvc-code-analysis-action@04825f6d9e00f87422d6bf04e1a38b1f3ed60d99 | ||
| # Provide a unique ID to access the sarif output path | ||
| id: run-analysis | ||
| with: | ||
| cmakeBuildDirectory: ${{ env.build }} | ||
| # Ruleset file that will determine what checks will be run | ||
| ruleset: NativeRecommendedRules.ruleset | ||
|
|
||
| # Upload SARIF file to GitHub Code Scanning Alerts | ||
| - name: Upload SARIF to GitHub | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: ${{ steps.run-analysis.outputs.sarif }} | ||
|
|
||
| # Upload SARIF file as an Artifact to download and view | ||
| # - name: Upload SARIF as an Artifact | ||
| # uses: actions/upload-artifact@v4 | ||
| # with: | ||
| # name: sarif-file | ||
| # path: ${{ steps.run-analysis.outputs.sarif }} |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| # Security Policy | ||
|
|
||
| ## Supported Versions | ||
|
|
||
| Use this section to tell people about which versions of your project are | ||
| currently being supported with security updates. | ||
|
|
||
| | Version | Supported | | ||
| | ------- | ------------------ | | ||
| | 5.1.x | :white_check_mark: | | ||
| | 5.0.x | :x: | | ||
| | 4.0.x | :white_check_mark: | | ||
| | < 4.0 | :x: | | ||
|
|
||
| ## Reporting a Vulnerability | ||
|
|
||
| Use this section to tell people how to report a vulnerability. | ||
|
|
||
| Tell them where to go, how often they can expect to get an update on a | ||
| reported vulnerability, what to expect if the vulnerability is accepted or | ||
| declined, etc. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| This a document to library Java JavaBooks | ||
| You read this a document already new programist | ||
| learn Java,He tired.To used JavaBooks | ||
| For your anti-tired |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| java JDK | ||
| ======== | ||
| bat files 400 | ||
| exportfile in java | ||
| codejava in JDK |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Copilot Autofix
AI 1 day ago
To fix the problem, add an explicit
permissionsblock that grants only the minimum required scopes to theGITHUB_TOKEN. Since this workflow checks out code and runs Gradle locally,contents: readis sufficient and matches the recommendation.The best way to fix this without changing existing functionality is to add
permissions: contents: readat the job level underbuild:(so it applies only to this job) or at the workflow root. Because CodeQL highlighted the job’sruns-online, we will set the permissions for that specific job. Concretely, edit.github/workflows/android.ymland insert apermissions:section betweenbuild:andruns-on: ubuntu-latest, with two-space indentation underbuild:and four-space indentation forcontents: read.No additional methods, imports, or definitions are needed—this is purely a declarative change in the workflow YAML.