New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix security issues flagged by GitHub CodeQL #312

Open

2 tasks

bsweger opened this issue Feb 7, 2025 · 0 comments

Assignees

Milestone

Variant Nowcast

Collaborator

bsweger commented Feb 7, 2025 •

edited

Loading

Background

We recently enabled security scanning on the variant-nowcast-hub repo, and the initial scan flagged some things to fix: https://github.com/reichlab/variant-nowcast-hub/security/code-scanning

There are 17 alerts, but only two root causes, both of which are straightforward to fix.

Definition of done

All workflows have explicit permissions
All workflows reference third-party GitHub actions by commit hash instead of by tag

bsweger added this to Lab Work

bsweger converted this from a draft issue

bsweger self-assigned this

bsweger added this to the Variant Nowcast milestone

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment