Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 76 additions & 0 deletions .github/workflows/c_actions.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
# Copyright (c) 2020 The University of Manchester
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# This workflow will install Python dependencies, run tests, lint and rat with a variety of Python versions
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: C Actions
on: [push]
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v2
- name: Checkout SupportScripts
uses: actions/checkout@v2
with:
repository: SpiNNakerManchester/SupportScripts
path: support

- name: Install Ubuntu packages
uses: SpiNNakerManchester/SupportScripts/actions/apt-get-install@main
with:
packages: doxygen gcc-arm-none-eabi
- name: Configure Python 3.12
# Note: Python is needed for spinn_utilities.make_tools when building
uses: actions/setup-python@v2
with:
python-version: 3.12

- name: Checkout SpiNNaker C Dependencies
uses: SpiNNakerManchester/SupportScripts/actions/install-spinn-deps@main
with:
# Note: SpiNNUtils needed for spinn_utilities.make_tools
repositories: >
spinnaker_tools spinn_common SpiNNFrontEndCommon sPyNNaker

- name: "Prepare: Install SpiNNUtils"
uses: SpiNNakerManchester/SupportScripts/actions/install-spinn-deps@main
with:
# Note: SpiNNUtils needed for spinn_utilities.make_tools
repositories: SpiNNUtils
install: true

- name: Build SpiNNaker C code
env:
SPINN_INSTALL_DIR: ${{ github.workspace }}/spinnaker_tools_install
SPINN_COMMON_INSTALL_DIR: ${{ github.workspace }}/spinn_common_install
FEC_INSTALL_DIR: ${{ github.workspace }}/fec_install
SPYNNAKER_INSTALL_DIR: ${{ github.workspace }}/spynnaker_install
CFLAGS: -fdiagnostics-color=always
run: |
make -C spinnaker_tools install
make -C spinn_common install
make -C SpiNNFrontEndCommon/c_common install
make -C sPyNNaker/neural_modelling install

- name: Build SpiNNaker C code globally
env:
CFLAGS: -fdiagnostics-color=always
run: |
make -C spinnaker_tools
make -C spinn_common
make -C SpiNNFrontEndCommon/c_common
make -C sPyNNaker/neural_modelling
Comment on lines +22 to +76

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 7 days ago

In general, to fix this class of issue you add an explicit permissions block either at the workflow root (to apply to all jobs by default) or inside each job (to scope per job). You then restrict GITHUB_TOKEN to the least privileges needed, often contents: read for simple CI workflows that only need to clone the repo.

For this specific workflow, the steps only check out code, install dependencies, and run build commands. None of them appear to require write access to repository contents or other GitHub resources. The simplest, least intrusive fix is to add a workflow‑level permissions block right after the name: or on: key, with contents: read. This will apply to the build job and any future jobs unless they override it. Concretely, in .github/workflows/c_actions.yml, add:

permissions:
  contents: read

between the name: C Actions and on: [push] lines (or between on: and jobs:; both are valid, but placing it near the top is conventional). No additional methods, imports, or definitions are required because this is a YAML configuration change only.

Suggested changeset 1
.github/workflows/c_actions.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/c_actions.yml b/.github/workflows/c_actions.yml
--- a/.github/workflows/c_actions.yml
+++ b/.github/workflows/c_actions.yml
@@ -16,6 +16,8 @@
 # For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
 
 name: C Actions
+permissions:
+  contents: read
 on: [push]
 jobs:
   build:
EOF
@@ -16,6 +16,8 @@
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: C Actions
permissions:
contents: read
on: [push]
jobs:
build:
Copilot is powered by AI and may make mistakes. Always verify output.
Loading