chore: fix CI perms

[michen00]

Potential fix for https://github.com/michen00/bin/security/code-scanning/3

In general, the fix is to add an explicit permissions block to the workflow or to the specific job so the GITHUB_TOKEN has only the minimal required permissions (here, likely just contents: read). This documents the workflow’s needs and prevents it from accidentally gaining broader permissions if org/repo defaults change.

The single best way to fix this without changing functionality is to add a workflow-level permissions section near the top of .github/workflows/validate-scripts.yml, after the on: block (or before concurrency:), setting contents: read. This will apply to all jobs (currently just validate) that don’t override permissions, and is sufficient for actions/checkout@v6 and reading repo files. No other scopes (like pull-requests or issues) are required by the shown steps. No imports or external dependencies are needed; we only modify the YAML configuration.

Concretely, in .github/workflows/validate-scripts.yml, between the push: block ending at line 22 and the concurrency: block starting at line 24, insert:

permissions:
  contents: read

This change constrains GITHUB_TOKEN to read-only repository contents while preserving existing behavior.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[qodo-code-review]

Review Summary by Qodo

Add explicit permissions to validate-scripts workflow

🐞 Bug fix

Walkthroughs

Description

• Add explicit permissions block to workflow
• Constrains GITHUB_TOKEN to read-only repository access
• Fixes code scanning alert for missing permissions declaration
• Prevents accidental permission escalation from org defaults

Diagram

flowchart LR
  A["validate-scripts.yml"] -->|add permissions block| B["GITHUB_TOKEN constrained"]
  B -->|contents: read only| C["Security alert resolved"]

Loading

File Changes

1. .github/workflows/validate-scripts.yml 🐞 Bug fix +3/-0

Add permissions block for GITHUB_TOKEN scope

• Added workflow-level permissions block after on: section
• Set contents: read to constrain GITHUB_TOKEN scope
• Applies minimal required permissions for checkout and file reading
• Resolves code scanning alert about missing permissions declaration

.github/workflows/validate-scripts.yml

---

[qodo-code-review]

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: Run Tests (macos-latest)

Failed stage: Setup BATS [❌]

Failed test name: ""

Failure summary: The action failed during a step that downloads and installs bats-core: - The curl command that fetches bats-core from https://.../repos/bats-core/bats-core/tarball/v${VERSION} returned curl: (56) The requested URL returned error: 403 (HTTP Forbidden). - The log shows env: GITHUB_TOKEN: is empty, so the request likely lacked required authentication and/or was blocked by GitHub rate limits/permissions, causing the download to fail and the step to exit with code 1.

Relevant error logs: 1: ##[group]Runner Image Provisioner 2: Hosted Compute Agent ... 160: �[36;1mmkdir -p ${TEMPDIR}�[0m 161: �[36;1mmkdir -p ${DESTDIR}�[0m 162: �[36;1m�[0m 163: �[36;1mcurl -sL --retry 4 --retry-connrefused "${AUTH_ARGS[@]}" "${URL}/repos/bats-core/bats-core/tarball/v${VERSION}" | tar xz -C ${TEMPDIR} --strip-components 1 && cd ${TEMPDIR}�[0m 164: �[36;1m�[0m 165: �[36;1m./install.sh ${DESTDIR}�[0m 166: �[36;1mecho "Bats v${VERSION} installed in ${DESTDIR}"�[0m 167: �[36;1mecho "${DESTDIR}/bin" >> "$GITHUB_PATH"�[0m 168: �[36;1mecho "bats-installed=true" >> $GITHUB_OUTPUT�[0m 169: �[36;1m�[0m 170: �[36;1mrm -rf ${TEMPDIR} || exit 0�[0m 171: shell: /bin/bash --noprofile --norc -e -o pipefail {0} 172: env: 173: GITHUB_TOKEN: 174: ##[endgroup] 175: curl: (56) The requested URL returned error: 403 176: ##[error]Process completed with exit code 1. 177: Post job cleanup.