Potential fix for code scanning alert no. 10: Workflow does not contain permissions

[GoodPie]

Potential fix for https://github.com/GoodPie/modular_tree/security/code-scanning/10

In general, the fix is to declare a permissions block in the workflow so jobs do not implicitly inherit the repository default GITHUB_TOKEN permissions. We should define least-privilege defaults at the workflow root (applies to all jobs), and then override them only for jobs that need broader permissions.

For this specific file, the safest, non‑functional‑changing approach is:

• Add a workflow‑level permissions block after name (line 1) that sets contents: read (and optionally other read-only scopes if needed). This constrains all jobs by default.
• Add a job‑level permissions block for the release job because it uses softprops/action-gh-release@v2 to update/create GitHub releases, which needs to write to repository contents/releases. The minimal sensible permission is contents: write for that job alone.
• The other jobs (lint, test, build-wheels, test-python, package-addon) use checkout, artifacts, Python tooling, etc., but do not modify repo contents via the API, so the root contents: read is sufficient and should not be overridden.

Concretely:

• In .github/workflows/CD.yml, insert:

permissions:
  contents: read

on new line 2, shifting the rest down.

• Inside the release job definition (around existing line 116), add:

    permissions:
      contents: write

directly under runs-on: ubuntu-latest (or after needs: and runs-on:), to scope elevated permissions to this job only.

No additional methods, imports, or external dependencies are needed; this is purely a YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses a security alert by implementing least-privilege permissions for the GitHub Actions workflow. The change restricts the default GITHUB_TOKEN permissions to read-only at the workflow level, while granting write permissions only to the release job that specifically needs it.

Changes:

• Added workflow-level permissions block with contents: read as the default for all jobs
• Added job-level permissions block with contents: write for the release job that creates GitHub releases

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.