Restrict submit-repos workflow token permissions

[Copilot]

Bug Fix

Code scanning alert #2 flagged .github/workflows/submit-repos.yml for missing explicit workflow permissions. This change removes reliance on repository-default GITHUB_TOKEN scopes and documents the workflow’s least-privilege access.

• What was the bug?

  • submit-repos.yml had no permissions block.
  • The workflow therefore inherited default token permissions, which may be broader than required.

• How did you fix it?

  • Added a root-level permissions block with contents: read.
  • Kept workflow behavior unchanged; repository-modifying API calls still use the GitHub App token created in the job.

• Example

  permissions:
    contents: read

[Copilot]

Pull request overview

Adds an explicit least-privilege permissions block to the submit-repos.yml workflow to address a code scanning alert flagging missing workflow token permissions. Repository-modifying operations continue to use a separate GitHub App token created within the job, so behavior is unchanged.

Changes:

• Added root-level permissions: contents: read to .github/workflows/submit-repos.yml.

Show a summary per file

File	Description
.github/workflows/submit-repos.yml	Declares minimal contents: read token scope for the workflow.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0

[antgrutta]

Looks good, we're using the GH App to do the issue submit any way.