In general, the fix is to add an explicit permissions block to the workflow (either at the top level so it applies to all jobs, or directly under the specific job) and restrict GITHUB_TOKEN to the least privileges required. This workflow only checks out the repository and runs a script, so contents: read is sufficient.

The best minimally invasive fix here is to add a job-level permissions block under check-curly-quotes: specifying contents: read. This keeps the change tightly scoped to the job that CodeQL flagged and avoids assumptions about other jobs (none are shown). Concretely, in .github/workflows/check-curly-quotes.yml, under jobs: check-curly-quotes: name: Check for curly quotes, insert a permissions: mapping with contents: read at the standard indentation level. No imports or other definitions are needed; this is pure workflow configuration.