Potential fix for code scanning alert no. 142: Workflow does not contain permissions

[damianh]

Potential fix for https://github.com/DuendeSoftware/docs.duendesoftware.com/security/code-scanning/142

In general, the fix is to add an explicit permissions block to the workflow (either at the top level or per job) that grants only the minimal access needed. For this workflow, the only required permission is read access to repository contents so that actions/checkout can fetch the source code; no write operations are present.

The best way to fix this without changing functionality is to add a root-level permissions section directly under the workflow name: (or equivalently right after the on: block) specifying contents: read. Root-level permissions will apply to all jobs that don’t override them, which suits this simple single-job workflow. Specifically, in .github/workflows/ci.yml, insert:

permissions:
  contents: read

near the top of the file (e.g., after name: ci). No imports or extra definitions are needed, and no steps or job structure must change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.