Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[bdeitte]

Potential fix for https://github.com/bdeitte/hot-shots/security/code-scanning/2

To fix this, we should explicitly define a permissions block to restrict the GITHUB_TOKEN used by this workflow/job to the least privilege required. Since this CI workflow only needs to check out the repository and run builds/tests, it typically only requires contents: read. In many cases, you can even set permissions: {} or permissions: read-all, but the recommended minimal explicit permissions for this pattern is contents: read.

The best fix with minimal functional impact is to add a permissions block at the workflow root (so it applies to all jobs) just after the on: section, or at the jobs.build level. Here, adding it at the root is clean and clear: insert

permissions:
  contents: read

between the on: block (lines 6–10) and the jobs: block (line 12). No imports or additional methods are needed, since this is purely a YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

Adds explicit GitHub Actions token permissions to address code scanning alert #2 by restricting the workflow’s GITHUB_TOKEN to least-privilege.

Changes:

• Define workflow-level permissions for the CI workflow.
• Restrict token scope to contents: read for checkout/build/test.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.