chore(ci): declare least-privilege permissions on the desktop e2e workflow

[waleedlatif1]

Summary

• Add a top-level permissions: contents: read block to .github/workflows/desktop-e2e.yml — it was the only workflow in the repo without one, so both its jobs inherited the repo-default GITHUB_TOKEN scope
• Closes CodeQL alerts refactor: use chonkie locally #474 and refactor: use chonkie locally #475 ("Workflow does not contain permissions", Medium)
• Matters most for the latest canary leg, which runs bun add -d electron@latest and pulls an unpinned dependency tree onto the runner

Type of Change

• Chore / CI hardening

Testing

Tested manually — the workflow is workflow_dispatch-only and neither job reads secrets.GITHUB_TOKEN beyond checkout, so read-only is sufficient

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 12, 2026 4:38pm

[cursor]

PR Summary

Low Risk
CI-only hardening that narrows token scope; no application or runtime behavior changes.

Overview
Adds a workflow-level permissions: contents: read block to .github/workflows/desktop-e2e.yml, matching other repo workflows and closing CodeQL “workflow does not contain permissions” findings.

Both jobs (e2e with pinned/electron@latest canary, and package-smoke) previously inherited the repository default GITHUB_TOKEN scope; read-only is enough for checkout, Bun/Playwright runs, and failure artifact uploads.

^{Reviewed by Cursor Bugbot for commit bf4241c. Configure here.}

[greptile-apps]

Greptile Summary

This PR applies least-privilege token access to the manually dispatched desktop E2E workflow.

• Adds a workflow-level contents: read permission.
• Preserves sufficient access for repository checkout without granting unnecessary write scopes.

Confidence Score: 5/5

The PR appears safe to merge with no actionable issues identified.

The workflow only needs read access to check out repository contents, while its remaining setup, test, packaging, and artifact operations do not require broader GITHUB_TOKEN repository permissions.

Important Files Changed

Filename	Overview
.github/workflows/desktop-e2e.yml	Adds an appropriate read-only repository permission without disrupting the workflow’s checkout, test, packaging, or artifact-upload steps.

_{Reviews (1): Last reviewed commit: "chore(ci): declare least-privilege permi..." | Re-trigger Greptile}