Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Document required workflow permissions (README regression)

Open
#1,913 5 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
30/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Stale
Tech stack
github-actions
Domain
documentation

Research direction

Compare the current README with the linked older README revision, then review the linked CodeQL code-scanning documentation to identify where workflow permissions belong. Done means the required permissions for private repositories, including why they are needed, are documented in an easily found location.

Written by the indexing model from the issue text.

Description

CodeQL Action documentation good first issue

Hello,

I've come across quite a few issues in the repo here that seem to boil down to people not knowing what permissions are needed for enabling CodeQL to work in their workflows. I believe for private repo they are:

      # required for all workflows
      security-events: write

      # only required for workflows in private repositories
      actions: read
      contents: read

These were documented in an old version of the README, which was super helpful. This was removed by this commit.

The documentation the current README points to seems to focus around enabling CodeQL or Advanced Security for new repos or enabling it for the first time.

But we have several repos that have been around for some time. It doesn't seem right that we should disable/remove CodeQL only to re-enable it using the "defaults" listed above.

I've clicked through all of the links that the current README point to but none of them describe what permissions the code scanning features require. This information seems important to capture somewhere. As a security minded organization, we want to make sure we're only enabling the minimum set of permissions in a repo, and it would be helpful to understand also why a certain action requires a particular permission.

Could we please add a note on permissions on either the About code scanning with CodeQL page, or one that is easily found from that page?

Thanks!

Dominant language
TypeScript
Stars
1.6k
Forks
493
Avg merge
1d 13h
Merged PRs (30d)
44

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/codeql-action

All issues in github/codeql-action

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.