successfully changed the Level-1/code.yml

[Debshibraj123]

Summary

Changes

Closes:

Task list

• For workflow changes, I have verified the Actions workflows function as expected.
• For content changes, I have reviewed the style guide.

[jkcso]

@dduzgun-security What do you think?

[dduzgun-security]

I think it would be good if we keep the permissions section since it restricts the default GITHUB_TOKEN permission used in the GitHub Action to only contents: read.

[dduzgun-security]

Good idea to remove the Check out code step here. It would be nice to mention it as an item below in the Solution Explanation. Maybe something like: # 7. Think about removing unnecessary steps in the GitHub Actions.

Note

In this example the checkout step copies the code in a GitHub runner but we actually don't need that step to run a simple curl. Removing it reduces the code of being copied (gain in time) and therefore reduces the potential risk of code exposure if an attacker has access to the runner or finds a way to exploit the actions/checkout GitHub Action (gain in security).

[jkcso]

Thank you @dduzgun-security, feel free to suggest code + solution additions in the PR, make sure that you test too and I will review at the end to accept :-) Thanks!

[dduzgun-security]

👋 Hey @Debshibraj123, what do you think about the requested changes? I would have loved to suggest code change but it doesn't allow on removed lines of code.

[jkcso]

@Debshibraj123 any updates here please?

[nxhettry]

Guys i am a beginner, this suddenly appeared in my pull request. What is this? Someone tell me.

[nxhettry]

What are these comments and commits related to?

[jkcso]

@nxhettry don't worry my friend, nothing to do here for you

[dduzgun-security]

@jkcso If that sounds good with you, let's merge this and I'll address the comment in another PR