Non-essential warnings from Actions Workflow Security Scan
- Dominant language
- Shell
- Stars
- 8
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
We have the `scan-pr` (Google GitHub Admin: Actions Workflow Security Scan) workflow configured to check pull-request for the [quantumlib/Cirq](https://github.com/quantumlib/Cirq) repository. However, the workflow produces some warnings which appear to ask for fixups in configuration, please see the example below.
Would it be possible to address these so we avoid non-essential warnings in successful scans?
----
Workflow run: https://github.com/quantumlib/Cirq/actions/runs/21697490339
```
Annotations
2 warnings
scan-pr
Feature flags do not specify a default CLI version. Falling back to the CLI version shipped with the Action. This is 2.23.5.
scan-pr
This run of the CodeQL Action does not have permission to access the CodeQL Action API endpoints. As a result, it will not be opted into any experimental features. This could be because the Action is running on a pull request from a fork. If not, please ensure the workflow has at least the 'security-events: read' permission. Details: Resource not accessible by integration - https://docs.github.com/rest
```
Contributor guide
Assessment
This issue has not been assessed yet.