jenkins-infra / jenkins-security-scan

GitHub Workflow and Action for the Jenkins Security Scan
MIT License
1 stars 6 forks source link

Drop permissions #7

Closed daniel-beck closed 2 years ago

daniel-beck commented 2 years ago

Resolves #4.

Tested on a public repo main branch, a public PR from fork, and a private repo's main branch.

Interestingly, security-events: write is needed even though the action works from forks. My best guess is that there's a different code path involved on forks, or perhaps PRs in general.