Harden Qodana workflow permissions and checkout pin

2026-06-02 00:04:10 +02:00
parent dd4c9da86c
commit eb66b343ea
1 changed files with 3 additions and 4 deletions
@@ -11,14 +11,13 @@ jobs:
  qodana:
    runs-on: ubuntu-latest
    permissions:
-      contents: write
-      pull-requests: write
-      checks: write
+      contents: read
    steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # to check out the actual pull request commit, not the merge commit
          fetch-depth: 0  # a full history is required for pull request analysis
+          persist-credentials: false
      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.3
        with: