Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[davep]

Potential fix for https://github.com/davep/hike/security/code-scanning/1

In general, the fix is to add an explicit permissions block limiting the GITHUB_TOKEN to the minimal scopes required. For a typical lint/test workflow that only checks out code and runs local tools, contents: read is sufficient, and this is the recommended minimal baseline from GitHub and CodeQL.

For this specific workflow, the single best fix without changing existing functionality is to add a permissions block at the workflow root (top level), just under the name: line and before on:. This will apply to all jobs in the workflow, including style-lint-and-test, and will restrict GITHUB_TOKEN to read-only repository contents. None of the listed steps obviously need write or other special scopes, so this should be safe. No imports or additional methods are needed; it’s a pure YAML configuration change inside .github/workflows/style-lint-and-test.yaml.

Concretely:

• Edit .github/workflows/style-lint-and-test.yaml.
• Insert:

permissions:
  contents: read

• Place it after line 1 (name: Code quality tests) and before the existing on: block (current line 3). No other modifications are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.