Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[selemondev]

Potential fix for https://github.com/selemondev/shiki-code-block/security/code-scanning/1

In general, to fix this type of issue you add an explicit permissions: block at the workflow root or per job, granting only the minimum scopes required. Since this workflow appears only to need read access to repository contents (it uses tags, checks out code, builds, and then uses external tokens for changelog and npm publishing), we can safely set contents: read as the only permission for GITHUB_TOKEN.

The best minimal change is to add a permissions: block at the top level of .github/workflows/release.yml so it applies to all jobs in this workflow. Insert it right after the name: Release line and before the on: block, as recommended in the background. No imports or additional definitions are needed because this is pure workflow YAML; we are only tightening the GITHUB_TOKEN’s scope, not altering any commands or environment variables. The rest of the workflow remains unchanged.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflow configuration for the release process.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

The pull request adds a permissions block to the GitHub Actions release workflow, granting read access to repository contents. This is a configuration-only modification with no changes to workflow steps or logic.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Configuration .github/workflows/release.yml	Added permissions block granting contents: read at workflow level

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• Potential fix for code scanning alert no. 3: Workflow does not contain permissions #46 — Adds an identical permissions block with contents: read to .github/workflows/ci.yml, suggesting a coordinated permissions hardening pattern across workflows.

Poem

🐰 Hop, hop, the permissions now aligned,
Read-only access, security refined!
No unneeded power in the workflow's hand,
Just what is needed—precisely planned! ✨

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 4f1e26f and 750c420.

📒 Files selected for processing (1)

• .github/workflows/release.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}