Potential fix for code scanning alert no. 5: Workflow does not contain permissions

[SachaMorard]

Potential fix for https://github.com/edgee-cloud/ga-component/security/code-scanning/5

To fix this, explicitly declare permissions so that the GITHUB_TOKEN used in the workflow has only the minimal scopes required. Because multiple jobs here only need to read the repository contents, we can define a root-level permissions: contents: read that applies to all jobs, and then override it in specific jobs that need additional rights. The clippy job already correctly narrows itself to checks: write, so we should keep that. The coverage job, which reports to Coveralls, typically needs to create or update checks, so we should give it checks: write in addition to contents: read.

Concretely:

• In .github/workflows/check.yml, add a workflow-level permissions: block right after the on: section (before env:), setting contents: read.
• Leave clippy’s existing permissions: checks: write as-is (job-level permissions override the workflow default).
• Add a permissions: block to the coverage job specifying both contents: read and checks: write, inserted directly under runs-on: ubuntu-latest.

No additional imports or external libraries are needed; this is purely a YAML configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[coveralls]

Pull Request Test Coverage Report for Build 20655788650

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 98.753%

---

Totals
Change from base Build 19767089413:	0.0%
Covered Lines:	950
Relevant Lines:	962

---

💛 - Coveralls