Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[andyleejordan]

Potential fix for https://github.com/PowerShell/PowerShellEditorServices/security/code-scanning/3

Add an explicit permissions block to the workflow so GITHUB_TOKEN is least-privileged by default.

Best fix here (without changing functionality): add at workflow root (after on and before jobs) a minimal permission set:

• contents: read

This applies to all jobs unless overridden and is sufficient for this workflow’s current steps (not creating releases, commenting on PRs, or pushing commits).

File to edit:

• .github/workflows/emacs-test.yml
• Insert new lines between existing line 10 and line 12 (between trigger config and jobs:).

No imports, methods, or dependencies are needed.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses code scanning alert #3 ("Workflow does not contain permissions") by adding an explicit least-privilege permissions block to the emacs-test.yml GitHub Actions workflow. By default, GITHUB_TOKEN is granted broad permissions; scoping it to contents: read follows the principle of least privilege without changing the workflow's behavior, since all steps (checkout, build, run Emacs tests) only read repository contents.

Changes:

• Added a root-level permissions: block with contents: read between the on triggers and the jobs definition.