Add explicit permissions to settings.yml workflow (alert #3)

[Copilot]

Bug Fix

What was the bug?

The configure_repo job in .github/workflows/settings.yml had no permissions block, leaving GITHUB_TOKEN scope governed by repo/org defaults — which may be read-write and violate least-privilege (CodeQL actions/missing-workflow-permissions, CWE-275).

How did you fix it?

Added permissions: contents: read at the job level. The two privileged steps (Setup Custom Properties, Setup Repository Variables) already use a dedicated ISSUE_SUBMIT_TOKEN secret, so the GITHUB_TOKEN only needs read access for checkout and config loading.

jobs:
  configure_repo:
    runs-on: ubuntu-latest
    permissions:
      contents: read   # ← added

[antgrutta]

Looks good, there is a separate token used for operating on the target organizations and repos so this is fine.

[Copilot]

Pull request overview

Adds an explicit least-privilege permissions block to the configure_repo job in .github/workflows/settings.yml, addressing CodeQL alert actions/missing-workflow-permissions (CWE-275). The privileged steps use a separate ISSUE_SUBMIT_TOKEN, so contents: read is sufficient for the default GITHUB_TOKEN.

Changes:

• Add job-level permissions: contents: read to the configure_repo job.

Show a summary per file

File	Description
.github/workflows/settings.yml	Adds explicit contents: read permissions to the configure_repo job to satisfy least-privilege.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0