Potential fix for code scanning alert no. 146: Workflow does not contain permissions

[derekmisler]

Potential fix for https://github.com/docker/cagent-action/security/code-scanning/146

In general, the fix is to add an explicit permissions block that grants the minimal required scopes for the job. Here, the job just checks out the code and runs actionlint; it does not push changes, create issues, or modify pull requests, so contents: read is sufficient, and for extra safety we can set all permissions to none and override contents to read.

The single best fix with no behavior change is to add a permissions block either at the workflow root (before jobs:) or scoped to the actionlint job. To keep the change narrow and local, we’ll add it under jobs.actionlint, e.g.:

jobs:
  actionlint:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    ...

This restricts the GITHUB_TOKEN used in this job to read-only repository contents. No imports or external definitions are needed beyond this YAML change. Only .github/workflows/lint-actions.yml is modified, near line 18–20.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.