Actions Permission and Other CodeQL Fixes

.github/workflows/blossom-ci.yml

@@ -13,12 +13,8 @@ on:
             required: false
 
 permissions:
-  actions: write
-  checks: write
-  contents: write
-  issues: write
-  pull-requests: write
-  repository-projects: write
+  contents: read
+  pull-requests: read
   statuses: write
 
 jobs:
@@ -54,7 +50,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           repository: ${{ fromJson(needs.Authorization.outputs.args).repo }}
-          ref: ${{ fromJson(needs.Authorization.outputs.args).ref }}
+          ref: ${{ fromJson(needs.Authorization.outputs.args).sha }}
           lfs: 'true'
 
       # repo specific steps

.github/workflows/build_docs.yml

@@ -12,6 +12,9 @@ on:
       - main
       - releasing/*
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: build-docs-${{ github.event.pull_request.number || github.ref }}

.github/workflows/chatops.yml

@@ -1,6 +1,9 @@
 # triggering the workflows by commenting `/black` and `/integration-test`
 name: chatops
 
+permissions:
+  contents: read
+
 # currently dispatches /black command to project-monai/monai-code-formatter
 on:
   issue_comment:

.github/workflows/cicd_tests.yml

@@ -21,6 +21,9 @@ on:
       - '**.rst'
       - 'docs/**'
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: cicd-tests-${{ github.event.pull_request.number || github.ref }}

.github/workflows/conda.yml

@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: conda-tests-${{ github.event.pull_request.number || github.ref }}

.github/workflows/cron-ngc-bundle.yml

@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: bundle-tests-${{ github.event.pull_request.number || github.ref }}

.github/workflows/cron.yml

@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cron-gpu:
     if: github.repository == 'Project-MONAI/MONAI'

.github/workflows/docker.yml

@@ -13,6 +13,9 @@ on:
   # This is to trigger building/testing docker image from dev only.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   versioning_dev:
     # compute versioning file from python setup.py

.github/workflows/integration.yml

@@ -5,6 +5,9 @@ on:
   repository_dispatch:
     type: [integration-test-command]
 
+permissions:
+  contents: read
+
 jobs:
   integration-auto3dseg:
     container:

.github/workflows/pythonapp-gpu.yml

@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: build-gpu-${{ github.event.pull_request.number || github.ref }}

.github/workflows/pythonapp-hyena-gpu.yml

@@ -22,6 +22,9 @@ name: hyena-gpu
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: hyena-gpu-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/release.yml

@@ -8,6 +8,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   packaging:
     runs-on: ubuntu-latest

.github/workflows/setupapp.yml

@@ -13,6 +13,9 @@ on:
     # Allows you to run this workflow manually from the Actions tab
     workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: deploy-${{ github.event.pull_request.number || github.ref }}

monai/apps/utils.py

@@ -378,7 +378,7 @@ def get_filename_from_url(data_url: str) -> str:
             filename = re.findall('filename="?([^";]+)"?', content_disposition)
             if filename:
                 return str(filename[0])
-        if "drive.google.com" in data_url:
+        if urlparse(data_url).netloc == "drive.google.com":
             response = requests.get(data_url)
             if "text/html" in response.headers.get("Content-Type", ""):
                 soup = BeautifulSoup(response.text, "html.parser")