.github/workflows/e2e.yaml (2)

18-34: ⚠️ Potential issue | 🟠 Major

Declare explicit least-privilege permissions for this workflow.

There is no permissions block (Lines 18-34). Add explicit minimal scopes to avoid relying on defaults.

Suggested minimal permissions baseline

 on:
   push:
     branches:
       - main
   pull_request:
+
+permissions:
+  contents: read

As per coding guidelines, ".github/workflows/**/*.yaml: Permissions: Ensure permissions are set to least privilege required for the workflow."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/e2e.yaml around lines 18 - 34, Add an explicit top-level
permissions block to the workflow (affecting the e2e job) granting
least-privilege scopes required by the used actions: at minimum set contents:
read for actions/checkout@v3 and any action that needs repo contents, and add
only the specific extras your composite action requires (for example
pull-requests: write if the vdaas/vald-client-ci action needs PR write access
and id-token: write if it uses OIDC). Insert a top-level permissions: section
above jobs with only those minimal scopes (e.g., permissions: { contents: read,
pull-requests: write, id-token: write } adjusted to actual needs) instead of
relying on defaults so the e2e workflow and the referenced uses:
actions/checkout@v3 and uses: vdaas/vald-client-ci/.github/actions/e2e@main have
explicit least-privilege access.

---

28-32: ⚠️ Potential issue | 🟠 Major

Pin container image and action references to immutable digests and commit SHAs.

Line 28 uses :nightly and line 32 uses @main—both mutable references that can change behavior and security posture without code changes. Per GitHub Actions security best practices, pin the container image to its digest (sha256:...) and the action to a full commit SHA to prevent supply chain attacks from upstream changes.

Consider also pinning actions/checkout@v3 on line 31 to its full commit SHA rather than a version tag for consistency.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/e2e.yaml around lines 28 - 32, Replace mutable refs with
immutable pins: update the container image string
"ghcr.io/vdaas/vald/vald-dev-container:nightly" to use its immutable sha256
digest, change the action reference
"vdaas/vald-client-ci/.github/actions/e2e@main" to the action's full commit SHA,
and likewise pin "actions/checkout@v3" to a specific commit SHA; ensure you
fetch the correct digest and commit SHAs for the exact versions you intend to
run and substitute those values in the image and action references.