Fix private repository checkout by adding job-level permissions

[Copilot]

Private repositories fail CI because workflows declare permissions: {} at the top level, preventing actions/checkout from authenticating.

Changes

Added permissions: contents: read to jobs requiring repository checkout:

ci.yaml

• qa job
• test job
• build job

check-links.yaml

• check-links job

docs.yaml and update-pre-commits.yaml already had appropriate job-level permissions.

Example

jobs:
  qa:
    runs-on: ubuntu-latest
    permissions:
      contents: read  # Added
    steps:
      - uses: actions/checkout@v6.0.2
        with:
          persist-credentials: false

When top-level permissions are explicitly denied, job-level grants enable checkout actions to authenticate against private repositories without requiring explicit token parameters.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud