Update GitHub Actions

StanfordBDHG · May 17, 2024 · 4395dba · 4395dba
1 parent 52b7ea0
commit 4395dba
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 2 deletions.
diff --git a/.github/workflows/beta-deployment.yml b/.github/workflows/beta-deployment.yml
@@ -19,14 +19,18 @@ jobs:
     name: Build and Test
     uses: ./.github/workflows/build-and-test.yml
     permissions:
-      security-events: write
+      contents: read
       actions: read
+      security-events: write
+    secrets: inherit
   iosapptestflightdeployment:
     name: iOS App TestFlight Deployment
     needs: buildandtest
     uses: StanfordBDHG/.github/.github/workflows/xcodebuild-or-fastlane.yml@v2
-    secrets: inherit
+    permissions:
+      contents: read
     with:
       runsonlabels: '["macOS", "self-hosted"]'
       setupsigning: true
       fastlanelane: beta
+    secrets: inherit
diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
@@ -20,6 +20,15 @@ jobs:
   swiftlint:
     name: SwiftLint
     uses: StanfordBDHG/.github/.github/workflows/swiftlint.yml@v2
+  codeql:
+    name: CodeQL
+    uses: StanfordBDHG/.github/.github/workflows/xcodebuild-or-fastlane.yml@v2
+    with:
+      codeql: true
+      fastlanelane: codeql
+    permissions:
+      security-events: write
+      actions: read
   buildandtest:
     name: Build and Test
     uses: StanfordBDHG/.github/.github/workflows/xcodebuild-or-fastlane.yml@v2
@@ -33,3 +42,5 @@ jobs:
     uses: StanfordBDHG/.github/.github/workflows/create-and-upload-coverage-report.yml@v2
     with:
       coveragereports: LLMonFHIR.xcresult
+    secrets:
+      token: ${{ secrets.CODECOV_TOKEN }}