Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[paulirwin]

Potential fix for https://github.com/paulirwin/neoluke/security/code-scanning/1

To fix the problem, you should explicitly declare a permissions block to restrict the default GITHUB_TOKEN access. The safest minimal approach is to set permissions: { contents: read } at the top level of the workflow. This restricts all jobs to only the read permission on repository contents, which is sufficient for building and testing code. Place this permissions key at the top of the file, directly under the name:/workflow title (line 5), or directly between name: and on:. No further code or dependency changes are needed.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a GitHub security code scanning alert by adding explicit permissions to the GitHub Actions workflow. The change restricts the default GITHUB_TOKEN to read-only access to repository contents, following security best practices.

• Added a permissions block with contents: read to limit token access
• Positioned the permissions block between the workflow name and trigger events

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}