Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[Severswoed]

Potential fix for https://github.com/BitPadLabs/GlowStatus/security/code-scanning/1

To resolve this problem, an explicit permissions block must be added at the workflow root (top-level, before jobs:) in .github/workflows/windows-build.yml specifying the required permissions for GITHUB_TOKEN. Adding this block ensures the workflow does not inherit unnecessary write permissions—the most minimal block should be contents: read, which is sufficient for source code read-only operations. However, since this workflow uploads release artifacts via GitHub Release (softprops/action-gh-release), it also needs contents: write for tagging/releases and possibly packages: write if using the Packages API (but not here). Therefore, the best fix is to add:

permissions:
  contents: write

directly below name: ... and before on: ....
This will apply this permission to all jobs unless a job further overrides or restricts it.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR adds an explicit permissions block to the Windows Build workflow to address GitHub code scanning alert #1. The change enforces the principle of least privilege by explicitly defining contents: write permission instead of allowing the workflow to inherit default write permissions.

• Adds top-level permissions block with contents: write to .github/workflows/windows-build.yml

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The permissions block should be placed after the on: trigger definition, not before it, following GitHub Actions best practices. The recommended structure is: name → on → permissions → jobs. This ensures clarity about when permissions are needed and improves readability. Move the permissions block to appear after line 22 (after the on: section completes).

[Copilot]

Consider applying more granular permissions at the job level instead of workflow level. The build-windows job needs contents: write for creating GitHub releases (line 289), but the publish-chocolatey job only needs contents: read to download artifacts. Applying contents: write at the workflow level grants this permission to all jobs unnecessarily. Move this to job-level permissions: add permissions: { contents: write } under the build-windows job (line 25) and permissions: { contents: read } under publish-chocolatey (line 332).