[Copilot]

GitHub Actions workflows lacked explicit permissions declarations, flagged as a security issue. Workflows using pull_request_target are particularly sensitive as they execute in the base repository context with access to secrets.

Changes

Added minimal required permissions to all workflows:

• build_and_test.yml: contents: read - for checkout and build operations
• releases.yml: contents: read - for release event processing
• semantic-pr.yml: pull-requests: read - for PR title validation
• spell-check-lint.yml: contents: read - for checkout operations

Example

name: Semantic PR

on:
  pull_request_target:
    types: [opened, edited, synchronize]

permissions:
  pull-requests: read

jobs:
  main:
    name: Validate semantic PR title
    runs-on: ubuntu-latest
    steps:
      - uses: amannn/action-semantic-pull-request@v4
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Follows principle of least privilege by granting only the minimum permissions each workflow requires.

Original prompt

Fix the issue "Workflow does not contain permissions" in this repo

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[CLAassistant]

All committers have signed the CLA.

[coveralls]

Pull Request Test Coverage Report for Build 19498279113

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 85.581%

---

Totals
Change from base Build 18982928146:	0.0%
Covered Lines:	4609
Relevant Lines:	5191

---

💛 - Coveralls