Potential fix for code scanning alert no. 33: Workflow does not contain permissions

[shibayan]

Potential fix for https://github.com/shibayan/Sharprompt/security/code-scanning/33

In general, the fix is to explicitly declare a permissions: block that grants only the scopes needed by the workflow, instead of relying on inherited defaults. For this build-and-test workflow, only read access to repository contents is required, so we can safely restrict GITHUB_TOKEN to contents: read.

The single best fix without changing functionality is to add a workflow-level permissions: block after the on: trigger (or, alternatively, a job-level block under build:). A workflow-level block is simpler and applies to all jobs that don't override it. Specifically, in .github/workflows/build.yml, between the on: section (lines 3–7) and the env: section (line 9), insert:

permissions:
  contents: read

No additional methods, imports, or definitions are needed, and none of the existing steps need modification.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses GitHub code scanning alert #33 by adding an explicit permissions block to the build workflow, following the principle of least privilege for GitHub Actions workflows. The change restricts the GITHUB_TOKEN to only contents: read, which is the minimal permission required for a build-and-test workflow.

Changes:

• Added workflow-level permissions block to .github/workflows/build.yml granting only contents: read access

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.