Potential fix for code scanning alert no. 9: Workflow does not contain permissions

[kaitlynnefuery]

Potential fix for https://github.com/hashicorp/dev-portal/security/code-scanning/9

In general, to fix this category of issue you add a permissions block either at the workflow root or within each job to explicitly scope what the automatically provided GITHUB_TOKEN can do. For a workflow that only checks out code and runs local tooling without calling GitHub APIs to modify resources, contents: read is typically sufficient and aligns with GitHub’s recommended minimal baseline.

For this specific workflow (.github/workflows/register-preview-url.yml), the on-deploy job checks out the repository and runs Node-based tooling. None of the shown steps require write access to repository contents, issues, PRs, or other GitHub resources via GITHUB_TOKEN. The least-privilege fix is therefore to add a permissions block under jobs.on-deploy specifying contents: read. This directly addresses CodeQL’s warning and keeps existing behavior unchanged, since read access is already required to perform actions/checkout. Concretely, insert:

    permissions:
      contents: read

between runs-on: ubuntu-latest and if: ... in the on-deploy job. No imports or additional definitions are needed, as this is purely a YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dev-portal	Error		Feb 10, 2026 1:03am

[github-actions]

📦 Next.js Bundle Analysis

This analysis was generated by the next.js bundle analysis action 🤖

This PR introduced no changes to the javascript bundle 🙌