Updated unit tests; Added smoke tests; Updated INSTRUCTIONS.md#16
Updated unit tests; Added smoke tests; Updated INSTRUCTIONS.md#16
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: Android Integration Smoke | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Enable KVM | ||
| run: | | ||
| echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' \ | ||
| | sudo tee /etc/udev/rules.d/99-kvm4all.rules | ||
| sudo udevadm control --reload-rules | ||
| sudo udevadm trigger --name-match=kvm | ||
|
|
||
| - name: Install Flutter | ||
| run: | | ||
| curl -fsSL "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${FLUTTER_VERSION}-stable.tar.xz" -o "$RUNNER_TEMP/flutter.tar.xz" | ||
| tar -xf "$RUNNER_TEMP/flutter.tar.xz" -C "$RUNNER_TEMP" | ||
| echo "$RUNNER_TEMP/flutter/bin" >> $GITHUB_PATH | ||
|
|
||
| - name: Install package dependencies | ||
| run: flutter pub get | ||
|
|
||
| - name: Install example dependencies | ||
| working-directory: example | ||
| run: flutter pub get | ||
|
|
||
| - name: Run Android integration smoke test | ||
| uses: reactivecircus/android-emulator-runner@v2 | ||
| with: | ||
| api-level: 34 | ||
| arch: x86_64 | ||
| profile: pixel_6 | ||
| script: | | ||
| cd example | ||
| flutter test integration_test/app_smoke_test.dart -d emulator-5554 |
Check warning
Code scanning / CodeQL
Workflow does not contain permissions Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 days ago
In general, the fix is to explicitly declare permissions for the workflow or individual jobs so the GITHUB_TOKEN is restricted to the least privileges required. Since both validate and integration-smoke jobs only need to read repository contents (for actions/checkout) and do not perform any write operations, the minimal appropriate permission is contents: read.
The best fix without changing existing functionality is to add a workflow-level permissions block near the top of .github/workflows/release-checks.yml, applying to all jobs that do not declare their own permissions. Add:
permissions:
contents: readright after the on: block (for example, after line 4–5). This preserves all current behavior while ensuring the GITHUB_TOKEN is restricted. No imports or additional methods are needed; this is purely a YAML configuration change.
| @@ -3,6 +3,9 @@ | ||
| on: | ||
| workflow_call: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| env: | ||
| FLUTTER_VERSION: 3.27.4 | ||
|
|
2 participants
No description provided.