Potential fix for code scanning alert no. 6: Workflow does not contain permissions

[nstarman]

Potential fix for https://github.com/GalacticDynamics/optional_dependencies/security/code-scanning/6

In general, to fix this problem you add an explicit permissions block either at the workflow root (applies to all jobs that do not override it) or on the specific job. The block should grant only the scopes that job actually needs; for a status/aggregation job that only reads workflow metadata, permissions: contents: read (or even permissions: {} if no token use is needed) is typically sufficient.

For this workflow, the existing format and tests jobs already declare permissions: contents: read. The missing restriction is only in the status job, starting at line 65. To avoid changing behavior elsewhere, the best fix is to add a permissions block to that job alone. There is no evidence that status needs write access or any special scopes; it only runs re-actors/alls-green, which checks needs results. A minimal, consistent choice is:

permissions:
  contents: read

placed directly under runs-on: in the status job. No imports or other code changes are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (34522f0) to head (7566b56).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #45   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            3         3           
  Lines           81        81           
=========================================
  Hits            81        81           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR addresses code scanning alert #6 by explicitly restricting GITHUB_TOKEN permissions for the status job in the CI workflow, aligning it with the existing least-privilege setup used by the other jobs.

Changes:

• Add an explicit permissions block to the status job.
• Restrict status to contents: read to satisfy workflow permission-hardening requirements.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.