Skip to content

Conversation

@fmuni
Copy link
Collaborator

@fmuni fmuni commented Oct 27, 2025

No description provided.

Comment on lines +15 to +62
runs-on: ubuntu-latest
defaults:
run:
shell: bash -l {0}
working-directory: ${{github.workspace}}
steps:
- name: Checkout
uses: actions/checkout@v4

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.13'
cache: 'pip'

- name: Set up micromamba
uses: mamba-org/setup-micromamba@v1
with:
environment-name: test-env
create-args: >-
python=${{ matrix.python-version }}
channels: conda-forge
channel-priority: strict
cache-downloads: true
cache-env: true

- name: Install dependencies
run: |
micromamba install --yes -n test-env -c conda-forge paraview
pip install --upgrade pip
pip install pytest
pip install pytest-cov
pip install -e .

- name: Generate coverage report
run: |
pytest --cov=./ --cov-report=xml:coverage.xml
- name: Upload coverage to Codecov

uses: codecov/codecov-action@v5
with:
token: ${{ secrets.CODECOV_TOKEN }}
file: ./coverage.xml
flags: unittests
env_vars: OS,PYTHON
name: codecov-umbrella
fail_ci_if_error: false
verbose: true

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 3 months ago

To address this CodeQL warning, we should add an explicit permissions block in the workflow file. Since none of the workflow steps write to the repository or require elevated privileges, the minimum required permission for GITHUB_TOKEN is contents: read. The best way to fix the problem is to add the following under the workflow's top-level keys, immediately after name: CodeCov and before on:. This will apply contents: read permissions to all jobs in the workflow unless a more specific permissions block is later added.

Suggested changeset 1
.github/workflows/codecov.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -1,4 +1,6 @@
 name: CodeCov
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -1,4 +1,6 @@
name: CodeCov
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
@fmuni fmuni merged commit 4ec813b into fmuni Oct 27, 2025
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants