[tomtau]

Potential fix for https://github.com/pest-parser/site/security/code-scanning/2

Add an explicit top-level permissions block to .github/workflows/publish.yml so all jobs default to least privilege unless overridden.
Best fix here: define workflow-wide permissions: contents: read near the top (after on:), and keep the existing gh-release job-level permissions unchanged (it already needs elevated pages: write and id-token: write).

This resolves the warning on the checks job (line 29) and also covers lint without altering job logic.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Chores
  • Updated access permissions for the automated publishing workflow. Release publishing retains its existing deployment permissions.
  • No changes to product features or user-facing behavior. These updates affect release automation only; they do not change how the product works or what users can do.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: a9ff8af3-9257-48aa-8900-f02395ebb87e

📥 Commits

Reviewing files that changed from the base of the PR and between 87a15db and 4419667.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The publish workflow now sets workflow-wide GITHUB_TOKEN permissions to contents: read. The gh-release job retains its job-level deployment permissions.

Changes

Publish workflow permissions

Layer / File(s)	Summary
Workflow token permissions .github/workflows/publish.yml	The workflow sets GITHUB_TOKEN permission to read repository contents. The gh-release job retains its own deployment permissions.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 44196

The workflow limits non-release jobs to repository-content read access while retaining the Pages deployment permissions. No affected operation is identified, so the change appears ready to merge.

Architecture Summary

Architecture risk: 🔵 Low · up to 44196

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/publish.yml: Adds workflow-level token permissions restricted to contents: read.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the purpose of the change: adding workflow permissions to address code-scanning alert no. 2.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The scoped permission resolves the warning without affecting deployment privileges.

Review effort: Balanced
Findings: None

What changed in this PR

Adds least-privilege default permissions to the publishing workflow.

Changes:

• Grants workflow jobs read-only repository contents access by default.
• Preserves deployment-specific permissions on gh-release.

File	Description
.github/​workflows/​publish.yml	Adds workflow-wide contents: read permissions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.