Potential fix for code scanning alert no. 5: Workflow does not contain permissions

[omeritzics]

Potential fix for https://github.com/omeritzics/Updatium/security/code-scanning/5

The best practice is to specify a permissions key at the earliest applicable scope. You can set it at the workflow root (top-level, affecting all jobs), or on each job (if some jobs require different permissions). According to the CodeQL message and the nature of the actions used, the minimal set is:

permissions:
  contents: read
  security-events: write

The contents: read allows for code checkout, and security-events: write grants the minimum required for uploading SARIF files to the Security tab with github/codeql-action/upload-sarif.

You should insert this permissions block at the top level, after the name: and before the on: block, for maximum clarity and coverage. No further code or configuration is required.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None