chore: set default permissions to least-privilege for workflow jobs

[twangodev]

Summary by CodeRabbit

• Chores
  • Enhanced build process security by implementing stricter default permission controls with least-privilege access.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5c64d0ac-6ebd-4f4b-9674-35cd293da055

📥 Commits

Reviewing files that changed from the base of the PR and between b011659 and f87d1ff.

📒 Files selected for processing (1)

• .github/workflows/build.yml

---

📝 Walkthrough

Walkthrough

Added a workflow-level permissions block to the GitHub Actions build workflow, setting default least-privilege access to contents: read. Existing job-level permission overrides for test and inspectCode jobs remain unchanged.

Changes

Cohort / File(s)	Summary
GitHub Actions Security Configuration .github/workflows/build.yml	Added workflow-level permissions: { contents: read } to establish default least-privilege access for all jobs, while preserving existing job-level permission overrides.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

A rabbit hops through workflows with care,
Permissions trimmed with security flair,
Read-only by default, least privilege shown,
Safe repos and secrets, now fully grown! 🐰🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and clearly describes the main change: adding a workflow-level permissions block with default least-privilege access (contents: read) to .github/workflows/build.yml.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/gha-permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Sets an explicit least-privilege default for GITHUB_TOKEN permissions in the Build GitHub Actions workflow, reducing the baseline access level for jobs that don’t need elevated scopes.

Changes:

• Adds a workflow-level permissions block defaulting to contents: read.
• Relies on existing job-level permission overrides (e.g., test, inspectCode) where broader access is required.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Qodana Community for JVM

It seems all right 👌

No new problems were found according to the checks applied

💡 Qodana analysis was run in the pull request mode: only the changed files were checked

View the detailed Qodana report

To be able to view the detailed Qodana report, you can either:

• Register at Qodana Cloud and configure the action
• Use GitHub Code Scanning with Qodana
• Host Qodana report at GitHub Pages
• Inspect and use qodana.sarif.json (see the Qodana SARIF format for details)

To get *.log files or any other Qodana artifacts, run the action with upload-result option set to true,
so that the action will upload the files as the job artifacts:

      - name: 'Qodana Scan'
        uses: JetBrains/qodana-action@v2025.1.1
        with:
          upload-result: true

Contact Qodana team

Contact us at qodana-support@jetbrains.com

• Or via our issue tracker: https://jb.gg/qodana-issue
• Or share your feedback: https://jb.gg/qodana-discussions