Feature: UX Improvements

[pacphi]

No description provided.

To fix the issue, a permissions block should be added to the workflow or the specific job, setting the minimum permissions needed. In this workflow, no steps require write permissions: all logic involves checking out code and running shell checks, so contents: read is sufficient. The permissions key can be placed at the top (affecting all jobs), or within the test-extensions-metadata job. Since there's only one job, either location is fine, but the top-level is simpler and clearer. Only .github/workflows/test-extensions-metadata.yml needs to be updated, with the key inserted after the workflow name: but before on:. No new methods, imports, or definitions are necessary; it's a single YAML edit.

---

General solution:
Add the permissions key at the root of the workflow or per job to explicitly limit the default GITHUB_TOKEN permissions to only those necessary.

Detailed implementation:
For this workflow, since the setup-config job does not interact with the repository or require elevated permissions, the safest minimal permission is contents: read. This allows reading workflow files (a minimal baseline).

To apply this change for all jobs (including future ones), add the following to the root/workflow-level (after the name: line but before on:). Alternatively, it can be added per job. Best practice is to set it at the workflow root if most jobs have the same minimal needs, then override per job if needed. Since the CodeQL warning is about job-level absence, and the snippet doesn't show workflow-level permissions, we'll add it both ways (recommend root-level unless requirements differ).

Changes needed:

• Add a permissions: block at the top of the workflow file, immediately after the name: declaration (line 2).
  • Value: contents: read
• No need for new imports, methods, or variable definitions.

---

To fix the problem, we should add an explicit permissions block at the root level of the workflow .github/workflows/extension-tests.yml. This will apply to all jobs unless a job-specific permissions block is used and is the recommended starting point for limiting the permissions of the GITHUB_TOKEN to the minimum required. For most CI workflows that simply run tests and build artifacts, contents: read is sufficient; additional access (e.g., pull-requests: write) should only be granted when necessary. Given that this workflow runs extension tests and triggers other sub-workflows but does not appear to need write access, we will add a minimal permissions block:

• Insert at the top level, after the name: section and before on::

  permissions:
    contents: read

• This change only affects the visible regions in the .github/workflows/extension-tests.yml file.

No code changes are needed in other files, and no dependencies are required.

---

To resolve this issue, an explicit permissions block should be added to the workflow YAML, either globally (at the root, applying to all jobs) or specifically to relevant jobs. The safest and most maintainable approach is to add the block at the root, so all jobs get the correct permissions unless they override locally. If some jobs require additional write permissions, specify them only where needed. For a minimal fix, start by adding a read-only permission for contents: read at the workflow top level, and only allow additional access (such as pull-requests: write) if jobs in this workflow actually require it. Edit .github/workflows/extension-tests.yml to add a permissions block at the top, just after the workflow name, before the on: trigger.

To fix this issue, add a permissions block specifying minimal required scopes either to the top-level of the workflow (affecting all jobs), or to the specific job(s) as appropriate. Since the cleanup-extensions-tests job (and likely the others) runs reusable workflows, and unless they require broader permissions, the safest default is:

permissions:
  contents: read

Add this block at the root of the workflow, directly below the name: declaration and above on:, so that all jobs inherit the least-privilege permissions unless overridden. This change will not affect workflow logic or outcome, but will restrict the default GitHub Actions token to only be able to read repository contents, and is backwards-compatible and consistent with the principle of least privilege.

Steps:

• Insert a permissions: block with at least contents: read immediately after the name: field on line 1.
• No further functional changes are required; no imports, no methods, and no other regions outside the provided lines need edits.

To fix this issue, explicitly set a permissions block at either the workflow level (top-level, applying to all jobs unless overridden) or per-job for those that require restrictive or specialized access. The most conservative fix is to declare a permissions block just under the workflow name: and before on:, for example setting all permissions to read. If any jobs require more extensive permissions (e.g., pull-requests: write), elevate as needed per job.

Best practice in modern CI is to start with:

permissions:
  contents: read

and only add additional permissions where required. Since the provided jobs mostly run external workflows and summary reports, it's likely that contents: read is sufficient at the top-level, but you can override per job as needed.

So, add:

permissions:
  contents: read

directly after the name: line (line 1).

---

To resolve this issue, you should explicitly limit the permissions granted to the GITHUB_TOKEN used by this workflow. The best practice is to set a global permissions block at the root of the YAML file to cover all jobs, unless specific jobs require additional or fewer privileges. For most workflows, contents: read suffices, unless jobs create or update pull requests, issues, or other objects. If in doubt, start with the lowest privilege (contents: read) and add others if needed.

• Add a permissions block at the root level (just after name: and before on:) as a minimal starting point, e.g., permissions: contents: read.
• If any job requires additional permissions (e.g., to update PRs), you can override this per-job by specifying a permissions block under that job.
• No methods or imports are needed; just a YAML edit in .github/workflows/integration.yml.

---

To resolve this issue: add a permissions block to the workflow file specifying only the minimal privileges necessary for linting and running checks. In this case, since no actions require write access, set contents: read at either the workflow root (global for all jobs) or within the specific job (more granular). The CodeQL message suggests starting with contents: read at minimum. Since there are no steps that need to modify contents, create issues, or anything requiring additional scopes, adding this at the root is the single best solution.

Edit .github/workflows/test-documentation.yml by adding the following block after the name: declaration and before the on: block:

permissions:
  contents: read

No additional imports or definitions are necessary.