Merge pull request nautilus-wraith#6 from nautilus-wraith/main

permission fixes

Author: jkosik-832gh8qwebc8

.github/workflows/securesdlc-required-workflow-dev.yml

@@ -9,6 +9,10 @@ on:
 
 jobs:
   securesdlc-umbrella:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@main
     secrets:
       SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}

.github/workflows/securesdlc-required-workflow.yml

@@ -9,6 +9,10 @@ on:
 
 jobs:
   securesdlc-umbrella:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status  
     uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@release-stable
     secrets:
       SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}

workflow-templates/securesdlc.yml

@@ -14,6 +14,10 @@ on:
 
 jobs:
   securesdlc-umbrella:
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status  
     uses: nautilus-wraith/securesdlc-umbrella/.github/workflows/securesdlc-umbrella.yml@release-stable
     secrets:
       SEMGREP_APP_URL: ${{ secrets.SEMGREP_APP_URL }}