sirbrillig / phpcs-variable-analysis

94%

2.x: 94%

LAST BUILD ON BRANCH feature/ghactions-set-minimal-permissions

branch: SELECT

CHANGE BRANCH

x

• No branch selected
• 2.x
• 3.x
• accept-namespaces-in-pass-by-ref-functions
• add-enum
• add-perf-ci-guard
• add-readonly-constructor-prom-support
• add/psalm
• add/scope-manager
• allow-empty-body-for-abstract-methods-without-unused
• allow-for-loop-increment-def-inside-loop
• dependabot/github_actions/action-runners-007b9456e6
• dependabot/github_actions/action-runners-599b765c23
• dependabot/github_actions/action-runners-5dacb66663
• dependabot/github_actions/action-runners-636cd4b091
• dependabot/github_actions/action-runners-6a98abd9ac
• dependabot/github_actions/action-runners-7a5a078ad4
• dependabot/github_actions/action-runners-823d5f4d9a
• dependabot/github_actions/actions/checkout-4
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/checkout-7.0.0
• dependabot/github_actions/coverallsapp/github-action-2
• dependabot/github_actions/phpcsstandards/xmllint-validate-2.0.0
• dependabot/github_actions/ramsey/composer-install-3
• dependabot/github_actions/ramsey/composer-install-4
• dependabot/github_actions/ramsey/composer-install-4.0.0
• do-not-search-arrow-func-index-always
• feature/add-dependabot-config-for-ghactions
• feature/allow-for-phpunit-11
• feature/composer-no-lock
• feature/composer-psalm
• feature/composer-raise-minimum-phpcs
• feature/cs-enforce-tabs
• feature/cs-qa-tests-declare-errorcodes-as-constants
• feature/cs-use-camelcase-variables
• feature/cs-use-psr2-braces
• feature/cs-various-tweaks
• feature/dependabot-introduce-cooldown-period
• feature/docs-align-param-comments
• feature/fix-phpstan-error
• feature/ghactions-cache-busting
• feature/ghactions-change-xmllint-validation
• feature/ghactions-do-not-persist-credentials
• feature/ghactions-improve-pins-dependabot
• feature/ghactions-minor-tweaks
• feature/ghactions-php-8.3-update
• feature/ghactions-set-minimal-permissions
• feature/ghactions-setup-php-fail-fast
• feature/ghactions-show-startup-errors
• feature/ghactions-switch-to-coveralls-reporter
• feature/ghactions-tweaks
• feature/ghactions-update-for-php-8.4-release
• feature/ghactions-update-for-php-8.5-release
• feature/ghactions-upgrade-php-coveralls-2.6.0
• feature/ghactions-various-minor-tweaks
• feature/ghactions-various-updates
• feature/ghactions-work-around-for-coveralls-reporting
• feature/ghactions-xmllint-bypass-apt-get-update
• feature/make-tests-compatible-with-phpcs-3.8.0
• feature/phpcs-switch-to-phpcsdevcs
• feature/switch-to-fork-of-phpcs
• feature/switch-to-ghactions-and-coveralls
• feature/update-for-1.0-release-of-composer-phpcs-plugin
• feature/update-phpcs-xsd-schema-url
• fix-anon-class-props-with-types
• fix-arrow-func-as-arg
• fix-constructor-promotion-with-namespace
• fix-destructure-bug
• fix-error-on-statement-find
• fix-nested-parens-types
• fix-nullable-constructor-promotion
• fix-ternary-in-arrow-func
• fix/another-static-var-detection
• fix/enum-detection-for-non-enums
• fix/func-call-detection
• fix/newlines-in-arrow-functions
• fix/pass-by-reference-unused
• handle-compact-in-fat-arrow
• handle-inline-if-list-destructure
• improve-initializer-behavior
• improve-nested-arrow-func-search
• phpcs-4.0
• pin-action-runner-versions
• remove-php-errormsg-from-superglobals
• run-static-analysis-on-8-1
• support-constructor-promotion
• support-nested-arrow-functions
• trunk
• v2.11.10
• v2.11.11
• v2.11.12
• v2.11.13
• v2.11.14
• v2.11.15
• v2.11.16
• v2.11.17
• v2.11.18
• v2.11.18-beta.1
• v2.11.18-beta.2
• v2.11.19
• v2.11.20
• v2.11.21
• v2.11.4
• v2.11.5
• v2.11.6
• v2.11.7
• v2.11.8
• v2.11.9
• v2.12.0
• v2.13.0
• v3.0.0
• v3.0.0-beta.10
• v3.0.0-beta.9

Build # 32164578528

Build Type

push

github

Committed by jrfnl

Commit Message

GH Actions: set permissions for each workflow/job

> Users frequently over-scope their workflow and job permissions, or set broad workflow-level permissions without realizing that all jobs inherit those permissions.
>
> Furthermore, users often don't realize that the _default_ `GITHUB_TOKEN` permissions can be very broad, meaning that workflows that don't configure any permissions at all can _still_ provide excessive credentials to their individual jobs.
>
> **Remediation**
> In general, permissions should be declared as minimally as possible, and as close to their usage site as possible.
>
> In practice, this means that workflows should almost always set `permissions: {}` at the workflow level to disable all permissions by default, and then set specific job-level permissions as needed.

Refs:
* https://docs.zizmor.sh/audits/#excessive-permissions

**Notes**:
* Includes a few minor tweaks for consistency in the instructions order.
* The permissions added are based on an best effort to discover the ones needed. Some tweaking may still be needed.

Coverage Stats

1749 of 1851 relevant lines covered (94.49%)

138.7 hits per line