Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Verify package-lock.json exists | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 5 | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Check if package-lock.json exists | ||
| run: | | ||
| if [ ! -f "package-lock.json" ]; then | ||
| echo "ERROR: package-lock.json file is missing from the repository" | ||
| echo "This file is required to ensure consistent dependency versions across all environments" | ||
| echo "Please ensure package-lock.json is committed with your changes" | ||
| exit 1 | ||
| fi | ||
| echo "SUCCESS: package-lock.json file is present" | ||
|
|
||
| - name: Verify package-lock.json is not empty | ||
| run: | | ||
| if [ ! -s "package-lock.json" ]; then | ||
| echo "ERROR: package-lock.json file exists but is empty" | ||
| echo "Please run 'npm install' to regenerate the lock file" | ||
| exit 1 | ||
| fi | ||
| echo "SUCCESS: package-lock.json file is valid and not empty" |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To fix the problem, explicitly set the GITHUB_TOKEN permissions to the minimum required for this workflow. Since it only checks out the repository and reads package-lock.json, it only needs read access to repository contents.
The best fix without changing functionality is to add a permissions block with contents: read. You can add this at the workflow root (so it applies to all jobs) or under the specific job. Following the CodeQL recommendation and keeping the change minimal, add a top-level permissions block after the on: section. Concretely, in .github/workflows/check-package-lock.yml, insert:
permissions:
contents: readbetween the on: block (ending at line 13) and the jobs: key at line 15. No imports or other definitions are needed.
| @@ -12,6 +12,9 @@ | ||
| branches: | ||
| - "**" # Run on PR to any branch | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| verify-package-lock: | ||
| name: Verify package-lock.json exists |
1 participant
package lock check