fix(security): Read-all and Write-all permissions should not be used in .github/workflows/codeql-analysis.yml.

[JiGuoDing]

Ⅰ. Describe what this PR does

This PR tries to replace read-all with specific permissions for security reasons.

Ⅱ. Does this pull request fix one issue?

fixes #5436

Ⅲ. List the added test cases (unit test/integration test) if any, please explain if no tests are needed.

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

This PR addresses a security issue by replacing overly permissive permissions: read-all with specific permissions in the CodeQL workflow, following the principle of least privilege as recommended in issue #5436.

Changes:

• Replaced permissions: read-all with explicit contents: read and actions: write permissions at the workflow level

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.25%. Comparing base (668b65b) to head (9df7cbe).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5437   +/-   ##
=======================================
  Coverage   56.25%   56.25%           
=======================================
  Files         443      443           
  Lines       30735    30735           
=======================================
  Hits        17290    17290           
  Misses      11880    11880           
  Partials     1565     1565           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cheyang]

/lgtm
/approve

[fluid-e2e-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cheyang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [cheyang]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment