Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[shawntz]

Potential fix for https://github.com/shawntz/cassh/security/code-scanning/1

To fix the problem, explicitly add a permissions block to the workflow file. The best, least-invasive approach is to add a permissions: key at the top level of the YAML file—directly below name: (and possibly after on:, but before jobs:)—so it applies to all jobs in the workflow. For this workflow, setting contents: read covers all steps that do not require write access to the repository (e.g., codecov only needs to upload to its own service, not write to the repo; uploading build artifacts goes to GitHub Actions, not the repo, etc.). If in the future a job requires write access, that job can set a more permissive block locally.

Specific steps:

• In .github/workflows/build.yml, add a permissions: block at the root level and set contents: read.
• Place this after the name: declaration and before the on: field for YAML validity.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses a code scanning security alert by adding explicit permissions configuration to the GitHub Actions workflow. The change implements the principle of least privilege by restricting the workflow to read-only access to repository contents.

Key changes:

• Added a top-level permissions block with contents: read to the build workflow

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shawntz]

fizzy