Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[Rui Xia (harrysummer)]

Potential fix for https://github.com/microsoft/visionmetrics/security/code-scanning/2

The best way to fix the problem is to explicitly restrict the GITHUB_TOKEN permissions by adding a permissions block to the workflow, following the principle of least privilege. In this workflow, the minimum required permission is to allow reading repository contents (e.g., for actions/checkout to read source code). This can be achieved by adding the following at the root level, just below the workflow name and above on::

permissions:
  contents: read

This applies the restriction to all jobs unless a job-specific permissions block overrides it. No other permissions are needed for the workflow's steps. Only one region of the file (.github/workflows/release.yml, near the top) needs to be edited to insert this block.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses a GitHub code scanning alert by adding explicit permissions to the release workflow and includes an unrelated dependency version pin. The primary change restricts the GITHUB_TOKEN to read-only access following the principle of least privilege.

• Added permissions: contents: read to the release workflow to address security alert
• Pinned pycocotools to version 2.0.8 (unrelated to workflow security fix)

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/release.yml	Added permissions block to restrict GITHUB_TOKEN to read-only access for security
setup.cfg	Pinned pycocotools version to 2.0.8 with explanatory comment (unrelated to PR purpose)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Julia Gong (juliagongms)]

Left one minor comment, but looks good otherwise. Thanks!