Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[reMRKableDev]

Potential fix for https://github.com/reMRKableDev/react-omdb-api/security/code-scanning/3

In general, the fix is to explicitly declare a permissions block that scopes the GITHUB_TOKEN to the least privileges the workflow needs. For this workflow, it only needs to read repository contents (for actions/checkout) and does not appear to need to write anything back to GitHub, so contents: read at the workflow or job level is sufficient. Other permissions like pull-requests, issues, etc. are not used here, so they should not be granted.

The single best fix with minimal impact is to add a permissions section at the top level of .github/workflows/test-coverage.yml, right after the name: and on: block or before jobs:. This will apply to all jobs that lack their own permissions block (here, the build job). We’ll set:

permissions:
  contents: read

No additional imports or methods are required, since this is purely a configuration change within the workflow YAML.

Concretely:

• Edit .github/workflows/test-coverage.yml.
• Insert a permissions: block between the on: section (lines 3–7) and the jobs: section (line 9), or directly above jobs:.
• Ensure indentation is correct (top-level keys, no extra spaces).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.55%. Comparing base (1e1ad7b) to head (ba72ff8).
⚠️ Report is 42 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #423   +/-   ##
=======================================
  Coverage   96.55%   96.55%           
=======================================
  Files           8        8           
  Lines          58       58           
  Branches        9        9           
=======================================
  Hits           56       56           
  Misses          2        2           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.