Feedback

[github-classroom]

👋! GitHub Classroom created this pull request as a place for your teacher to leave feedback on your work. It will update automatically. Don’t close or merge this pull request, unless you’re instructed to do so by your teacher.
In this pull request, your teacher can leave comments and feedback on your code. Click the Subscribe button to be notified if that happens.
Click the Files changed or Commits tab to see all of the changes pushed to the default branch since the assignment started. Your teacher can see this too.

Notes for teachers

Use this PR to leave feedback. Here are some tips:

• Click the Files changed tab to see all of the changes pushed to the default branch since the assignment started. To leave comments on specific lines of code, put your cursor over a line of code and click the blue + (plus sign). To learn more about comments, read “Commenting on a pull request”.
• Click the Commits tab to see the commits pushed to the default branch. Click a commit to see specific changes.
• If you turned on autograding, then click the Checks tab to see the results.
• This page is an overview. It shows commits, line comments, and general comments. You can leave a general comment below.
  For more information about this pull request, read “Leaving assignment feedback in GitHub”.

Subscribed: @IgpayAtenlay @shinushibu1798 @QtinzIa @bohan0lin @KimiChen2000 @qfcvds

To fix this issue, add an explicit permissions block to the workflow, either at the root level (to apply to all jobs by default) or per job. Since none of the jobs require write access to repository resources, setting permissions: contents: read at the root level is best practice. This limits the GITHUB_TOKEN to only read repository contents, minimizing risk. The change should be added immediately below the workflow name (name: CI Pipeline), before the on: block begins. No other modifications or additions are necessary for this change.

---

To fix this problem, we should add a permissions block limiting the GITHUB_TOKEN to the least privilege needed by all jobs. In this workflow, no job needs write access; they only need to check out repository code (which requires contents: read). The best practice is to set permissions: contents: read at the workflow root, so all jobs that don't specify their own permissions inherit it. This change should be made at the top level of .github/workflows/github-actions.yml, directly under the name: CI Pipeline key (or after it, before on:). Only this addition is required; no further imports or method definitions are needed.

The best fix is to explicitly add a permissions key with a minimal value at the workflow root (top-level, just after the name: field and before on:), to apply to all jobs by default. Since the workflow consists only of jobs that check out code and build/test, contents: read suffices. This change does not alter the existing functionality and adheres to the principle of least privilege, reducing the risk in case new steps are added or default permissions change.

Edit the file .github/workflows/github-actions.yml by inserting:

permissions:
  contents: read

just below the line containing name: CI Pipeline. No additional imports, method definitions, or dependencies are needed.

---