Wip

[Gérald Barré (geraldbarre-workleap)]

No description provided.

In general, to fix code injection warnings in GitHub Actions, untrusted or potentially untrusted values from expressions (${{ ... }}) should not be embedded directly in script bodies. Instead, assign them to environment variables via the env: block and then read them using the shell’s native variable syntax (e.g., $ENV:VAR in PowerShell, $VAR in bash). This prevents expression syntax from being evaluated in places where it could be interpreted as code.

For this specific case, we only need to adjust how github.action_path is passed into the PowerShell script. We will:

• Add a new environment variable (e.g., CI_ACTION_PATH) in the env: block of the composite action step, assigned from ${{ github.action_path }}.
• Update the Import-Module command to use $env:CI_ACTION_PATH instead of interpolating ${{ github.action_path }} directly in the script.

This preserves the existing behavior (importing RequiredChecksPolicy.psm1 from the action’s directory) while removing direct ${{ ... }} usage from inside the run: script. The only file to change is .github/actions/required-checks-policy/action.yml, lines around the env: block and the Import-Module call; no new imports or additional methods are needed.

In general, fix this by explicitly declaring a permissions block that grants only the minimal GITHUB_TOKEN permissions the workflow needs. You can add this either at the top level of the workflow (so it applies to all jobs that don’t override it) or under a specific job. For this workflow, the steps only need read access to repository contents (for actions/checkout) and do not need to write to the repo or to issues/PRs, so contents: read is sufficient.

The best minimal change without altering functionality is to add a root-level permissions block just below the name (and before on:) in .github/workflows/~internal-required-checks-policy.yml:

permissions:
  contents: read

This sets the default GITHUB_TOKEN permission to read-only for repository contents for all jobs in this workflow, leaving artifact uploads unaffected because they do not require additional repo write scopes. No new imports or external dependencies are needed; permissions is a native GitHub Actions workflow key.