[CLIENT-4350] Add runtime flag /RTC1 to raise an error when uninitialized read occurs

[juliannguyen4]

No description provided.

In general, to fix this issue you must explicitly declare a permissions: block in the workflow or in the specific job, restricting the GITHUB_TOKEN to the least privileges required (typically contents: read for workflows that only need to check out code). This overrides potentially broader repo/org defaults.

For this specific workflow, the simplest, non‑breaking fix is to add a root‑level permissions: block that applies to all jobs, immediately under the on: section. The job uses actions/checkout (which needs contents: read) but does not appear to need to write to the repository or manage issues, PRs, etc. Therefore contents: read is sufficient and safe. No changes are needed to steps or secrets usage; they are unaffected by the GITHUB_TOKEN scope.

Concretely, in .github/workflows/build-and-run-dev-tests-with-windows-python-dbg.yml, insert:

permissions:
  contents: read

between the trigger block (on: ...) and the jobs: key. No imports or additional methods are needed since this is a YAML configuration change only.

In general, the problem is fixed by adding an explicit permissions: block to the workflow or to the specific job so that the GITHUB_TOKEN is limited to the minimum required scope, typically contents: read (and other read scopes if needed). This documents the workflow’s expectations and prevents accidental elevation if repository or organization defaults change.

For this specific workflow, the smallest, least intrusive fix is to add a permissions: block at the root level of .github/workflows/stage-tests.yml, right after the on: definition. That block will apply to all jobs that do not override permissions, including windows-dbg. Since the shown jobs only check out code, run tests, pull Docker images, and use reusable workflows, they only need read access to repository contents; write permissions are not required. Therefore, we can safely set permissions: contents: read globally. No imports or additional methods are needed because this is a YAML configuration change only.

Concretely, in .github/workflows/stage-tests.yml, add:

permissions:
  contents: read

immediately after the on: block (after the workflow_call: configuration). This will satisfy CodeQL’s requirement and enforce least privilege for the GITHUB_TOKEN used by all jobs, including the windows-dbg job that reuses another workflow.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.48%. Comparing base (88dadfa) to head (e3a589f).
⚠️ Report is 1 commits behind head on dev.

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #990   +/-   ##
=======================================
  Coverage   83.48%   83.48%           
=======================================
  Files          99       99           
  Lines       14402    14402           
=======================================
  Hits        12024    12024           
  Misses       2378     2378           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.