Potential fix for code scanning alert no. 5: Workflow does not contain permissions

[BENZOOgataga]

Potential fix for https://github.com/Altitude-Interactive/CorpSim/security/code-scanning/5

In general, the fix is to add an explicit permissions block that grants only the minimal required access for the jobs. Since the jobs only need to read repository contents to run checks (checkout, filters, tests), contents: read is sufficient. Adding this at the top (workflow level) will apply to all jobs unless overridden, satisfying CodeQL’s requirement and limiting the GITHUB_TOKEN.

The best fix with minimal functional impact is to add a root-level permissions block right after the on: triggers and before concurrency:. This keeps the structure simple and applies to all three jobs. No steps in the provided snippet require write operations to the GitHub API (no status updates beyond the default Actions behavior, which works fine with contents: read), so we do not need any additional scopes like pull-requests: write. Concretely, in .github/workflows/verify.yml, insert:

permissions:
  contents: read

at the root level under the on: block. No other imports, methods, or definitions are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[greptile-apps]

No reviewable files after applying ignore patterns.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.