Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[Severswoed]

Potential fix for https://github.com/BitPadLabs/GlowStatus/security/code-scanning/2

To fix the problem, you should add a permissions: key at the root level of the workflow YAML file, before the jobs: block. This ensures that the permissions for the GITHUB_TOKEN are explicitly set to the minimal required scope for all jobs unless overridden locally. For this workflow, specifying permissions: contents: read will restrict the token so that it can only read repository contents, preventing accidental write access.

The changes should be made to .github/workflows/discord-setup.yml: add the following block after the workflow's name: and before the on: trigger:

permissions:
  contents: read

No imports, methods, or further definitions are necessary as this is a declarative change in the workflow YAML.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses a code scanning security alert by adding explicit permissions to the Discord Server Setup workflow. The change follows GitHub Actions security best practices by implementing the principle of least privilege - restricting the GITHUB_TOKEN to read-only access to repository contents, which is the minimum required for this workflow.

Key Changes:

• Added permissions: contents: read declaration to the workflow at the root level

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.