Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[kjdev]

Potential fix for https://github.com/kjdev/php-ext-cedar/security/code-scanning/1

Add an explicit permissions block at the workflow root in .github/workflows/ci.yml so it applies to all jobs unless overridden.
For this workflow, the minimal least-privilege setting is:

• contents: read

This preserves current behavior (checkout can still read source), documents required access, and prevents accidental broader token scopes if repository/org defaults are permissive or later changed.

Edit location:

• .github/workflows/ci.yml
• Insert permissions: after the on: triggers block and before jobs:.

No imports, methods, or external definitions are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Chores
  • Enhanced CI workflow security by implementing explicit read-only repository access permissions for automated workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1d35b8ae-11ff-4953-a7fb-a2bd01318979

📥 Commits

Reviewing files that changed from the base of the PR and between 65d68c9 and cdc6f80.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The CI workflow explicitly declares workflow-level permissions, granting the GITHUB_TOKEN read-only access to repository contents via the contents: read permission. No build, test, or job logic was changed.

Changes

CI Workflow Permissions

Layer / File(s)	Summary
Workflow permissions configuration .github/workflows/ci.yml	Top-level permissions block is added to the workflow, explicitly granting contents: read access to the GITHUB_TOKEN.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A permission slip so fine,
Read-only access in a line,
Security locked tight,
The token shines bright!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding workflow permissions to fix a code scanning alert about missing permissions in the CI workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch alert-autofix-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}