fix(security): Read-all and Write-all permissions should not be used in .github/workflows/codeql-analysis.yml.

[JiGuoDing]

Ⅰ. Describe what this PR does

This PR tries to replace read-all with specific permissions for security reasons.

Ⅱ. Does this pull request fix one issue?

fixes #5436

Ⅲ. List the added test cases (unit test/integration test) if any, please explain if no tests are needed.

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[fluid-e2e-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ronggu for approval by writing /assign @ronggu in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

Pull request overview

This PR addresses a security issue by replacing overly permissive permissions: read-all with specific permissions in the CodeQL workflow, following the principle of least privilege as recommended in issue #5436.

Changes:

• Replaced permissions: read-all with explicit contents: read and actions: write permissions at the workflow level

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.25%. Comparing base (668b65b) to head (9df7cbe).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5437   +/-   ##
=======================================
  Coverage   56.25%   56.25%           
=======================================
  Files         443      443           
  Lines       30735    30735           
=======================================
  Hits        17290    17290           
  Misses      11880    11880           
  Partials     1565     1565           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.