[#2794] Added 'pull-requests: read' permission to CI deploy job for 'gh pr view'.

[AlexSkrypnyk]

Closes #2794

Summary

The deploy job in .github/workflows/build-test-deploy.yml declared no permissions: block and inherited the repo-wide least-privilege contents: read default.
Its "Resolve deploy target" step runs gh pr view to resolve the PR head SHA and branch, which requires pull-requests: read, so a manual workflow_dispatch run with deploy_target=pr-<number> failed on private repos with Resource not accessible by integration.
This adds a job-level permissions: block granting contents: read (restated because a job-level block replaces rather than merges the inherited default, so checkout and artifact download keep their access) and pull-requests: read.
This mirrors the established pattern already used in .github/workflows/test-vr.yml, which declares pull-requests: read next to its own gh pr view call.

Changes

• Added a job-level permissions: block (contents: read + pull-requests: read) to the deploy job in .github/workflows/build-test-deploy.yml.
• Regenerated installer test fixtures (_baseline, deploy_types_none_gha, provision_profile) that snapshot this workflow.

Screenshots

N/A - non-visual CI configuration change.

Before / After

BEFORE                                       AFTER
┌──────────────────────────────────┐         ┌──────────────────────────────────┐
│ deploy:                          │         │ deploy:                          │
│   # no permissions: block        │         │   permissions:                   │
│   # -> inherits repo default     │         │     contents: read               │
│                                   │         │     pull-requests: read         │
├──────────────────────────────────┤         ├──────────────────────────────────┤
│ effective permissions:            │         │ effective permissions:            │
│   contents: read                 │         │   contents: read                  │
│   pull-requests: (none)          │         │   pull-requests: read            │
├──────────────────────────────────┤         ├──────────────────────────────────┤
│ Resolve deploy target step:      │         │ Resolve deploy target step:      │
│   gh pr view <number>            │         │   gh pr view <number>            │
│   -> 403 Resource not accessible │         │   -> 200 OK, PR head SHA and     │
│      by integration              │         │      branch resolved             │
│      (private repos only)        │         │                                   │
└──────────────────────────────────┘         └──────────────────────────────────┘

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow permissions to follow least-privilege access.
  • Set global workflow access to read-only repository contents.
  • Refined job-level permissions: the build job now explicitly allows writing checks and pull requests; the deploy job is restricted to read-only repository contents and pull requests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9c91c1ca-e432-45de-bd99-db7272ccab09

📥 Commits

Reviewing files that changed from the base of the PR and between 4b9eb0c and 6efb4cc.

⛔ Files ignored due to path filters (3)

• .vortex/installer/tests/Fixtures/handler_process/_baseline/.github/workflows/build-test-deploy.yml is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/deploy_types_none_gha/.github/workflows/build-test-deploy.yml is excluded by !.vortex/installer/tests/Fixtures/**
• .vortex/installer/tests/Fixtures/handler_process/provision_profile/.github/workflows/build-test-deploy.yml is excluded by !.vortex/installer/tests/Fixtures/**

📒 Files selected for processing (1)

• .github/workflows/build-test-deploy.yml

---

Walkthrough

The workflow clarifies default permissions, preserves the build job’s existing scopes, and adds explicit contents and pull-request read permissions to the deploy job.

Changes

Workflow permissions

Layer / File(s)	Summary
Explicit workflow and job permissions .github/workflows/build-test-deploy.yml	The workflow keeps contents: read, formats the build permissions explicitly, and grants the deploy job contents: read and pull-requests: read.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Poem

A rabbit checks the workflow bright,
Read-only paws set permissions right.
Contents and pull requests in view,
The deploy path knows what to do.
Hop, hop—CI runs true!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly names the deploy job permission change for gh pr view and matches the PR's main fix.
Linked Issues check	✅ Passed	The deploy job now has the required contents: read and pull-requests: read permissions for gh pr view, matching #2794.
Out of Scope Changes check	✅ Passed	The only other changes are permission comment and formatting cleanup with the same effective values, so no unrelated scope is evident.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/2794-deploy-pr-perms

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📖 Documentation preview for this pull request has been deployed to Netlify:

https://6a5850415103403266a2bf4b--vortex-docs.netlify.app

This preview is rebuilt on every commit and is not the production documentation site.

[github-actions]

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   98.55% (204/207)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)

[AlexSkrypnyk]

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   98.55% (204/207)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)

[AlexSkrypnyk]

Code coverage (threshold: 90%)

  Classes: 100.00% (1/1)
  Methods: 100.00% (2/2)
  Lines:   98.55% (204/207)

Per-class coverage

Drupal\ys_demo\Plugin\Block\CounterBlock
  Methods: 100.00% ( 2/ 2)   Lines: 100.00% ( 10/ 10)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.27%. Comparing base (3054b60) to head (f7dff23).
⚠️ Report is 5 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2797      +/-   ##
==========================================
- Coverage   86.71%   86.27%   -0.44%     
==========================================
  Files          97       90       -7     
  Lines        4757     4598     -159     
  Branches       47        3      -44     
==========================================
- Hits         4125     3967     -158     
+ Misses        632      631       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.