ci(ci.yml): add permissions

[chimurai]

Add an explicit permissions block at the workflow root (right after on:) so all jobs inherit least-privilege defaults unless they override them.
For this workflow, the minimal safe baseline recommended by CodeQL is:

• contents: read

This preserves current functionality for common CI tasks like checkout/build/lint/test while ensuring token scope is explicitly constrained. If any omitted jobs later need write scopes, those should be added narrowly at the specific job level, not globally.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow permissions configuration to explicitly restrict access to read-only, enhancing security controls.

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request adds an explicit top-level permissions block to the CI workflow, restricting GitHub Actions access to repository contents to read-only mode. The change enhances security by limiting the workflow's repository access capabilities.

Changes

CI Permissions Hardening

Layer / File(s)	Summary
Workflow Permission Configuration .github/workflows/ci.yml	Top-level permissions block declares contents: read, restricting GitHub Actions repository access to read-only.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A workflow once wild and free,
Now reads with certainty!
No writes shall breach this gate,
Permissions sealed, the code stays safe and great! 🔒✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title 'ci(ci.yml): add permissions' is concise and directly relates to the main change—adding a permissions block to the CI workflow.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch workflow-permissions

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

npm i https://pkg.pr.new/http-proxy-middleware@1227

commit: e4ce07f

[coveralls]

coverage: 94.07%. remained the same — workflow-permissions into master