Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[albertomandlate]

Potential fix for https://github.com/SimansoftMZ/BridgeBank/security/code-scanning/1

Add an explicit permissions block at the workflow root so all jobs inherit least-privilege token access unless overridden. For this workflow, the minimal and appropriate setting is:

• contents: read

This supports actions/checkout and typical CI operations without granting unnecessary write scopes. No new imports, methods, or dependencies are needed (YAML workflow change only).

Edit .github/workflows/ci.yml by inserting the permissions section between the existing concurrency block and jobs block (or anywhere at root level), preserving indentation and current behavior.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

Este PR ajusta o workflow de CI para mitigar o alerta de code scanning sobre ausência de um bloco permissions, aplicando o princípio de least-privilege ao GITHUB_TOKEN.

Changes:

• Adiciona permissions ao nível root do workflow.
• Define contents: read como permissão padrão para os jobs.

[Copilot]

Com o permissions limitado a apenas contents: read, o step actions/upload-artifact@v4 tende a falhar por falta de permissões (normalmente requer actions: write para criar/upload de artifacts). Para manter least-privilege sem quebrar o CI, adicione actions: write (ou defina permissions no job build-and-test apenas para actions: write + contents: read).

[albertomandlate]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Ajustei o workflow conforme a thread: adicionei actions: write mantendo contents: read em .github/workflows/ci.yml para permitir actions/upload-artifact@v4 sem ampliar escopos além do necessário. Commit: a7987b2.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

O bloco permissions adicionado não corresponde ao que foi descrito no PR ("minimal ... contents: read"): aqui também está a conceder actions: write. Se actions: write é necessário (ex.: para actions/upload-artifact), convém justificar/atualizar a descrição. Alternativamente, para manter o princípio de menor privilégio na raiz, deixe apenas contents: read no root e mova actions: write para jobs.build-and-test.permissions (apenas no job que realmente precisa).

[albertomandlate]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Feito. Mantive permissions na raiz com contents: read e movi o escopo adicional para jobs.build-and-test.permissions com actions: write (e contents: read) apenas no job que faz upload de artifact. Commit: a4669ba. Sem alterações de UI (não há screenshot aplicável).