Potential fix for code scanning alert no. 604: Workflow does not contain permissions

[derrabauke]

Potential fix for https://github.com/adfinis/ember-validated-form/security/code-scanning/604

In general, the fix is to explicitly define a permissions block that grants only the minimum required scopes for the GITHUB_TOKEN. Since these jobs only check out code, install dependencies, and run lint/tests, they only need read access to repository contents; they do not need write access or special scopes like pull-requests or issues.

The simplest, non-disruptive fix is to add a top-level permissions section to .github/workflows/ci.yml (so it applies to all jobs) with contents: read. This documents the intended permissions, prevents accidental escalation if repo/org defaults change, and does not alter current behavior for legitimate steps because none of them need write privileges.

Concretely:

• Edit .github/workflows/ci.yml.
• After the name: CI line (or anywhere at the top-level before jobs:), add:

permissions:
  contents: read

• No imports or additional methods are required; this is purely a YAML workflow configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[c0rydoras]

they only need read access to repository contents

we do OSS, none should work as well (as the repository is public)

[derrabauke]

they only need read access to repository contents

we do OSS, none should work as well (as the repository is public)

nice! Thx for the hint. Seemed a bit counter-intuitive but makes sense and works. ✨