fix(ci): grant missing permissions for lint-and-test reusable workflow

[wizzomafizzo]

Summary

• Add packages: read and security-events: write to the lint-and-test job permissions in build.yml, matching what lint-and-test.yml declares
• Fixes the tag push workflow failure where GitHub rejected the reusable workflow call because those permissions defaulted to none

Summary by CodeRabbit

• Chores
  • Updated CI/CD configuration permissions to enhance build and security capabilities.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a2ff2bbb-cd88-454b-ab1a-ccb44783fe20

📥 Commits

Reviewing files that changed from the base of the PR and between e707159 and 13f7701.

📒 Files selected for processing (1)

• .github/workflows/build.yml

---

📝 Walkthrough

Walkthrough

The pull request expands GitHub Actions workflow permissions in the build.yml file by adding packages: read and security-events: write to the lint-and-test job, and packages: write to the ensure-zigcc job, refining the security boundary for these CI jobs.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Permissions .github/workflows/build.yml	Added packages: read and security-events: write permissions to lint-and-test job; added packages: write to ensure-zigcc job for enhanced package and security event access.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• ci: harden workflows with pinned SHAs and explicit permissions #629 — Both PRs modify GitHub Actions workflow files with a focus on adjusting and refining job permissions in the build pipeline.

Poem

🐰 Hopping through the workflows with glee,
Permissions now flow where they need to be,
Security checked, packages aligned,
A cleaner pipeline, sanely designed! 🔐✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and specifically identifies the main change: granting missing permissions to the lint-and-test reusable workflow in the CI configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/build-workflow-permissions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!