Merge pull request #240 from copenhagentruckwash/propose-fix-for-ci-vulnerability

Secure Qodana pull request workflow
2026-06-01 23:36:53 +02:00
parent e3b38519fb e7481297c8
commit ce29cf9ccb
1 changed files with 5 additions and 5 deletions
@@ -9,12 +9,12 @@ on:

 jobs:
  qodana:
-    # Run on our self-hosted runner to avoid GitHub-hosted Actions budget limits.
-    runs-on: [self-hosted, Linux, X64, default]
+    # Use GitHub-hosted runners for PR scans so untrusted code never runs on persistent internal infrastructure.
+    runs-on: ubuntu-latest
    permissions:
-      contents: write
-      pull-requests: write
-      checks: write
+      contents: read
+      pull-requests: read
+      checks: read
    steps:
      - uses: actions/checkout@v4
        with: