Potential fix for code scanning alert no. 4: Workflow does not contain permissions

[pmalarme]

Potential fix for https://github.com/pmalarme/github-secrets/security/code-scanning/4

In general, to fix this issue you should explicitly set permissions for the GITHUB_TOKEN either at the top (workflow-level, affecting all jobs) or per job, and restrict them to the minimum required scopes, typically contents: read (and others only if actually needed). This both documents the intended access and prevents accidental broad write permissions if repository defaults are permissive.

For this specific workflow, none of the steps perform operations that require write access via GITHUB_TOKEN (they only echo text, read secrets, and write to GITHUB_STEP_SUMMARY). Therefore, the safest and simplest fix is to define a workflow-level permissions block with read-only contents. Place it near the top of .github/workflows/reusable_workflow_with_inherit.yaml, after the name and on sections but before jobs:. For example:

permissions:
  contents: read

This applies to both run-reusable-workflow and run-reusable-workflow-without-environment without altering their behavior, and it removes the CodeQL warning about missing permissions. No additional imports, methods, or other definitions are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.