Potential fix for code scanning alert no. 22: Workflow does not contain permissions

[htomasz]

Potential fix for https://github.com/htomasz/vultron/security/code-scanning/22

In general, the fix is to explicitly define a permissions: block to restrict the GITHUB_TOKEN to the minimal scopes required. For a linting and Semgrep scanning workflow that only needs to read repository code, contents: read is sufficient as a baseline.

The best fix here is to add a workflow-level permissions: block right after the name: or on: declaration in .github/workflows/lint-semgrep.yml. This will apply to all jobs (currently just lint) unless overridden. We’ll set contents: read, which allows checkout and scanning but prevents unintended write operations to the repo. No other scopes (pull-requests, issues, etc.) are needed based on the shown steps, and no existing behavior will be changed because the actions used do not require write access.

Concretely, in .github/workflows/lint-semgrep.yml, insert:

permissions:
  contents: read

between the on: block and jobs: (or directly after name: if preferred). No imports or additional methods are required, as this is pure YAML configuration.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[htomasz]

Approved