Potential fix for code scanning alert no. 9: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

.github/workflows/deploy-pr.yaml

@@ -20,21 +20,26 @@ jobs:
       pr_number: ${{ github.event.pull_request.number }}
     secrets: inherit
 
+  get_urls:
+    if: github.event.action != 'closed'
+    name: Generate Preview URLs
+    uses: ./.github/workflows/url_generator.yml
+    with:
+      runner: vhs
+      mode: pr
+      pr_number: ${{ github.event.pull_request.number }}
+      base_domain: ${{ vars.DEV_BASE_DOMAIN }}
+    secrets: inherit
+
   frontend:
     if: github.event.action != 'closed'
     name: Frontend - Build and Deploy to Cloudflare Pages (PR)
+    needs: [get_urls]
     uses: ./.github/workflows/frontend-pages.yml
     with:
       mode: pr
       pr_number: ${{ github.event.pull_request.number }}
-    secrets: inherit
-
-  get_urls:
-    if: github.event.action != 'closed'
-    uses: ./.github/workflows/url_generator.yml
-    with:
-      mode: pr
-      pr_number: ${{ github.event.pull_request.number }}
+      backend_url_scheme: ${{ needs.get_urls.outputs.backend_url_scheme }}
     secrets: inherit
 
   deploy:
@@ -70,12 +75,11 @@ jobs:
           DEV_BASE_DOMAIN: ${{ secrets.BASE_DOMAIN }}
           RABBITMQ_PASSWORD: ${{ secrets.PROD_RABBITMQ_PASSWORD }}
           DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
-          IMAGE_REPO: ${{ needs.build.outputs.image_repo }}
           DIGEST: ${{ needs.build.outputs.digest }}
-          DOMAIN: ${{ needs.get_urls.outputs.backend_url }}
-          DOMAIN_SCHEME: ${{ needs.get_urls.outputs.backend_url_scheme }}
-          FRONTEND_DOMAIN: ${{ needs.get_urls.outputs.frontend_url }}
-          FRONTEND_DOMAIN_SCHEME: ${{ needs.get_urls.outputs.frontend_url_scheme }}
+          DOMAIN: "${{ needs.get_urls.outputs.backend_url }}"
+          DOMAIN_SCHEME: "${{ needs.get_urls.outputs.backend_url_scheme }}"
+          FRONTEND_DOMAIN: "${{ needs.get_urls.outputs.frontend_url }}"
+          FRONTEND_DOMAIN_SCHEME: "${{ needs.get_urls.outputs.frontend_url_scheme }}"
         run: |
           PR=${{ github.event.pull_request.number }}
           RELEASE=myapp-pr-$PR
@@ -105,7 +109,7 @@ jobs:
             const prNumber = pr.number;
             const backendUrl = process.env.BACKEND_URL || '(not available)';
             const frontendUrl = process.env.FRONTEND_URL || '(not available)';
-            const marker = '<!-- preview-link -->';
+            const marker = '<!-- preview-comment-marker -->';
             const body = `${marker}\nPreview environment is running\n- Frontend: ${frontendUrl}\n- Backend: ${backendUrl}\n`;
             const { owner, repo } = context.repo;
             const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number: prNumber, per_page: 100 });

.github/workflows/deploy-prod.yaml

@@ -30,18 +30,22 @@ jobs:
       context: 7project/backend
     secrets: inherit
 
-  frontend:
-    name: Frontend - Build and Deploy to Cloudflare Pages (prod)
-    uses: ./.github/workflows/frontend-pages.yml
-    with:
-      mode: prod
-    secrets: inherit
-
   get_urls:
-    name: Get URLs
+    name: Generate Production URLs
     uses: ./.github/workflows/url_generator.yml
     with:
       mode: prod
+      runner: vhs
+      base_domain: ${{ vars.PROD_DOMAIN }}
+    secrets: inherit
+
+  frontend:
+    name: Frontend - Build and Deploy to Cloudflare Pages (prod)
+    needs: [get_urls]
+    uses: ./.github/workflows/frontend-pages.yml
+    with:
+      mode: prod
+      backend_url_scheme: ${{ needs.get_urls.outputs.backend_url_scheme }}
     secrets: inherit
 
   deploy:
@@ -76,8 +80,12 @@ jobs:
           FRONTEND_DOMAIN_SCHEME: ${{ needs.get_urls.outputs.frontend_url_scheme }}
           RABBITMQ_PASSWORD: ${{ secrets.PROD_RABBITMQ_PASSWORD }}
           DB_PASSWORD: ${{ secrets.PROD_DB_PASSWORD }}
-          IMAGE_REPO: ${{ needs.build.outputs.image_repo }}
           DIGEST: ${{ needs.build.outputs.digest }}
+          BANKID_CLIENT_ID: ${{ secrets.BANKID_CLIENT_ID }}
+          BANKID_CLIENT_SECRET: ${{ secrets.BANKID_CLIENT_SECRET }}
+          MOJEID_CLIENT_ID: ${{ secrets.MOJEID_CLIENT_ID }}
+          MOJEID_CLIENT_SECRET: ${{ secrets.MOJEID_CLIENT_SECRET }}
+
         run: |
           helm upgrade --install myapp ./7project/charts/myapp-chart \
             -n prod --create-namespace \
@@ -90,3 +98,7 @@ jobs:
             --set image.digest="$DIGEST" \
             --set-string rabbitmq.password="$RABBITMQ_PASSWORD" \
             --set-string database.password="$DB_PASSWORD"
+            --set-string oauth.bankid.clientId="$BANKID_CLIENT_ID" \
+            --set-string oauth.bankid.clientSecret="$BANKID_CLIENT_SECRET" \
+            --set-string oauth.mojeid.clientId="$MOJEID_CLIENT_ID" \
+            --set-string oauth.mojeid.clientSecret="$MOJEID_CLIENT_SECRET"

.github/workflows/frontend-pages.yml

@@ -15,6 +15,10 @@ on:
         description: 'Cloudflare Pages project name (overrides default)'
         required: false
         type: string
+      backend_url_scheme:
+        description: 'The full scheme URL for the backend (e.g., https://api.example.com)'
+        required: true
+        type: string
     secrets:
       CLOUDFLARE_API_TOKEN:
         required: true
@@ -26,17 +30,9 @@ on:
         value: ${{ jobs.deploy.outputs.deployed_url }}
 
 jobs:
-  get_urls:
-    uses: ./.github/workflows/url_generator.yml
-    with:
-      mode: ${{ inputs.mode }}
-      pr_number: ${{ inputs.pr_number }}
-    secrets: inherit
-
   build:
     name: Build frontend
     runs-on: ubuntu-latest
-    needs: [get_urls]
     defaults:
       run:
         working-directory: 7project/frontend
@@ -54,9 +50,9 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
-      - name: Set backend URL from url_generator
+      - name: Set backend URL from workflow input
         run: |
-          echo "VITE_BACKEND_URL=${{ needs.get_urls.outputs.backend_url_scheme }}" >> $GITHUB_ENV
+          echo "VITE_BACKEND_URL=${{ inputs.backend_url_scheme }}" >> $GITHUB_ENV
 
       - name: Build
         run: npm run build

.github/workflows/url_generator.yml

@@ -1,43 +1,73 @@
-name: url_generator
+name: Generate Preview or Production URLs
+
 on:
   workflow_call:
     inputs:
       mode:
-        description: "Mode: 'prod' or 'pr'"
+        description: "Build mode: 'prod' or 'pr'"
         required: true
         type: string
       pr_number:
         description: 'PR number (required when mode=pr)'
         required: false
         type: string
+      runner:
+        description: 'The runner to use for this job'
+        required: false
+        type: string
+        default: 'ubuntu-latest'
+      base_domain:
+        description: 'The base domain for production URLs (e.g., example.com)'
+        required: true
+        type: string
+
+    outputs:
+      backend_url:
+        description: "The backend URL without scheme (e.g., api.example.com)"
+        value: ${{ jobs.generate-urls.outputs.backend_url }}
+      frontend_url:
+        description: "The frontend URL without scheme (e.g., app.example.com)"
+        value: ${{ jobs.generate-urls.outputs.frontend_url }}
+      backend_url_scheme:
+        description: "The backend URL with scheme (e.g., https://api.example.com)"
+        value: ${{ jobs.generate-urls.outputs.backend_url_scheme }}
+      frontend_url_scheme:
+        description: "The frontend URL with scheme (e.g., https://app.example.com)"
+        value: ${{ jobs.generate-urls.outputs.frontend_url_scheme }}
 
 jobs:
-  get_urls:
-    runs-on: ubuntu-latest
+  generate-urls:
+    permissions:
+      contents: none
+    runs-on: ${{ inputs.runner }}
+
     outputs:
-      backend_url: ${{ steps.urls.outputs.backend_url }}
-      frontend_url: ${{ steps.urls.outputs.frontend_url }}
-      frontend_url_scheme: ${{ steps.urls.outputs.frontend_url_scheme }}
-      backend_url_scheme: ${{ steps.urls.outputs.backend_url_scheme }}
+      backend_url: ${{ steps.set_urls.outputs.backend_url }}
+      frontend_url: ${{ steps.set_urls.outputs.frontend_url }}
+      backend_url_scheme: ${{ steps.set_urls.outputs.backend_url_scheme }}
+      frontend_url_scheme: ${{ steps.set_urls.outputs.frontend_url_scheme }}
 
     steps:
-      - name: Compute URLs PROD
-        id: urls
+      - name: Generate URLs
+        id: set_urls
+        env:
+          BASE_DOMAIN: ${{ inputs.base_domain }}
         run: |
           set -euo pipefail
           
           if [ "${{ inputs.mode }}" = "prod" ]; then
-            BACKEND_URL="api.${{ secrets.PROD_DOMAIN }}"
-            FRONTEND_URL="finance.${{ secrets.PROD_DOMAIN }}"
-
+            BACKEND_URL="api.${BASE_DOMAIN}"
+            FRONTEND_URL="finance.${BASE_DOMAIN}"
           else
-            FRONTEND_URL="pr-${{inputs.pr_number}}.${{ secrets.DEV_FRONTEND_BASE_DOMAIN }}"
-            BACKEND_URL="api-pr-${{inputs.pr_number}}.${{ secrets.DEV_BASE_DOMAIN }}"
+            # This is your current logic
+            FRONTEND_URL="pr-${{ inputs.pr_number }}.group-8-frontend.pages.dev"
+            BACKEND_URL="api-pr-${{ inputs.pr_number }}.${BASE_DOMAIN}"
           fi
 
           FRONTEND_URL_SCHEME="https://$FRONTEND_URL"
           BACKEND_URL_SCHEME="https://$BACKEND_URL"
           
+          # This part correctly writes to GITHUB_OUTPUT for the step
           echo "backend_url_scheme=$BACKEND_URL_SCHEME" >> $GITHUB_OUTPUT
           echo "frontend_url_scheme=$FRONTEND_URL_SCHEME" >> $GITHUB_OUTPUT
           echo "backend_url=$BACKEND_URL" >> $GITHUB_OUTPUT