Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[rabestro]

Potential fix for https://github.com/fortemate/dicechess-bot-python/security/code-scanning/2

Add an explicit permissions block to the workflow so the GITHUB_TOKEN is least-privilege by default.
Best fix here (without changing behavior): add a root-level permissions block with contents: read, which is sufficient for this workflow since it only inspects PR event payload and does not write to repository resources.

Change location:

• File: .github/workflows/enforce-pr-policy.yaml
• Insert the block between the on: trigger section and jobs:.

No imports, methods, or extra definitions are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud