Potential fix for https://github.com/oopsio/nanosha256/security/code-scanning/2

In general, the fix is to add an explicit permissions section that grants only the minimal scopes the workflow needs. This workflow needs to read repository contents for actions/checkout, and there is no indication it needs to write to the repository or interact with issues/PRs, so contents: read is sufficient.

The best minimal change is to add a workflow-level permissions block right after the name: (or before jobs:), so it applies to all jobs by default. Specifically, edit .github/workflows/c-cpp.yml to insert:

permissions:
  contents: read

between the name: C/C++ CI line and the on: block. No other steps, jobs, or behavior need to be modified; this only constrains the implicit GITHUB_TOKEN used by the workflow. No additional imports, libraries, or tooling are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Chores
  • Updated internal CI/CD workflow configuration to enhance security permissions.

Note: This release contains no user-facing changes. All modifications are internal infrastructure improvements.