Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[ismailtsdln]

Potential fix for https://github.com/offsec-toolkit/linksleuth/security/code-scanning/1

In general, the problem is fixed by adding an explicit permissions: block that restricts the GITHUB_TOKEN to the minimal scopes required by the workflow. This can be done at the workflow root (applies to all jobs) or at individual job level. For this workflow, the job only needs to read repository contents to check out code, cache dependencies (keyed on files), run tests/lint, and upload coverage to Codecov. None of the steps require write access to contents, issues, pull requests, or other resources.

The single best fix here is to add a permissions: block with contents: read at the root level, just under the on: section and before jobs:. This will apply to the ci job (and any future jobs unless they override it), ensuring the GITHUB_TOKEN cannot be used for write operations on repository contents. No additional methods, imports, or definitions are necessary since this is a YAML workflow configuration change only. Concretely, edit .github/workflows/go.yml to insert:

permissions:
  contents: read

between the on: block (lines 3–7) and jobs: (line 9).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.