[Copilot]

This PR addresses the code scanning finding for missing explicit GITHUB_TOKEN permissions in workflow configuration. It applies least-privilege defaults at the workflow level while preserving required elevated permissions where already defined.

• Security posture update

  • Added an explicit top-level permissions block in .github/workflows/build.yml:
    • contents: read
  • This removes implicit broad defaults for jobs that only require repository read access.

• Permission model preservation

  • Left existing job-specific overrides intact (e.g., release path requiring write permissions), so only default scope is tightened.

permissions:
  contents: read

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions workflow by declaring explicit default GITHUB_TOKEN permissions in .github/workflows/build.yml, aiming to reduce implicit broad token scopes while preserving job-level overrides where needed.

Changes:

• Added a top-level permissions: block in the build workflow.
• Set the default workflow permission to contents: read.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.