Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[MiguelElGallo]

Potential fix for https://github.com/MiguelElGallo/mpzsql/security/code-scanning/1

To fix the issue, add a permissions block to the workflow file to explicitly set the minimum required permissions for the GITHUB_TOKEN. Since this workflow primarily checks out code, installs dependencies, runs tests, and uploads coverage to Codecov (an external service), it typically only requires contents: read permission. This permission setting should be added at the workflow or job level. The minimal fix is to add permissions: contents: read at the top level, just after the name: and before the on: block, so it applies to all jobs. No additional dependencies or method changes are required.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a security issue by adding explicit permissions to the GitHub Actions workflow. The change implements the principle of least privilege by restricting the GITHUB_TOKEN to only the minimum required permissions.

• Adds explicit permissions block with contents: read to limit workflow token access
• Addresses GitHub code scanning alert about missing workflow permissions

[Copilot]

[nitpick] The permissions block should be placed after the 'name' field according to GitHub Actions best practices. Move the permissions block to appear after line 3 (name: Tests) for better workflow organization.

Suggested change

	permissions:
	contents: read
	name: Tests
	name: Tests
	permissions:
	contents: read