Potential fix for code scanning alert no. 2: Workflow does not contain permissions - #5
Merged
Merged
Conversation
…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sun Haoran (haoranpb)
marked this pull request as ready for review
September 30, 2025 13:02
Wenjie Fan (gggdttt)
pushed a commit
that referenced
this pull request
Jul 1, 2026
- privacy-012: reword #1/#3/#5 - code uses direct Error(Label,args), not StrSubstNo; keep the valid PII-to-telemetry finding, drop the false StrSubstNo premise - style-011: drop 3 comments redundant with accurate AA0005 duplicates / no-rule indentation (20->17) - style-013: keep all + add missing real hardcoded-string findings incl. previously-unreviewed CustStPDFDocHandler (11->18); fix wrong quotes/lines - upgrade-006: drop 2 false positives claiming no delegation where code does delegate (9->7) - strip dangling '- See agent comment for details.' suffix from 89 comments (13 entries)
Marko Aleksandric (AleksandricMarko)
added a commit
that referenced
this pull request
Jul 31, 2026
…ding Applies Haoran's review feedback for the extensibility-request categories: - Rename to explicit `extensibility-request-implement` / `extensibility-request-triage` across category ids, enum members, classes, dataset files and module files (#1/#2/#4). - Slim both prompt templates to reflect real-world usage; category-specific rules now live in the ai-ext-fix / argus-triage skills (#3). - Merge duplicate `bcbench.results` import in commands/evaluate.py (#5). - Uptake #761: both ext entries subclass `RepoGroundedEntry` (#6/#7). - Triage `patch` defaults to None; stripped from the dataset (#8). - Constrain triage label fields with a `ManagedLabel` Literal to catch dataset typos (#9). - Move the ext dataset classes into dataset/extensibility_request.py, like code review (#10). - Drop `fetch_commit_if_missing` from both ext pipelines to match the other pipelines (#11). - Keep ext-implement judge-only for now; container build/publish noted as future work (#12). - Grade triage with the NL2AL LMChecklist instead of the code-review-style hybrid: `ExtRequestTriageResult` removed in favour of `JudgeBasedEvaluationResult`, expected_* fields replaced by an `expected` checklist, evaluators `lm_checklist`, core score `test_passed`; 17 triage entries migrated (#13/#14/#15/#16). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fb712366-b026-470c-9d09-1bd9e9f52a31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/microsoft/BC-Bench/security/code-scanning/2
How to fix the problem:
Explicitly add a
permissionsblock to the workflow to limit the GITHUB_TOKEN permissions to the minimum required. Since the jobs only need to read the repository contents (to checkout code and read secrets), the block should setcontents: read. This block can be added at the workflow level (to apply to all jobs), or per-job if differing permissions are needed. In this case, workflow-level (top-level) makes sense.Detailed steps:
.github/workflows/dataset-validation.yml.permissions:block after thename:line and before theon:block.contents: read(which is a minimal, safe default).Suggested fixes powered by Copilot Autofix. Review carefully before merging.