Potential fix for code scanning alert no. 12: Workflow does not contain permissions

[Xieyt]

Potential fix for https://github.com/rtCamp/Frappe-Manager/security/code-scanning/12

In general, the fix is to explicitly declare a permissions block limiting the GITHUB_TOKEN to the minimal scopes needed, either at the workflow root (applies to all jobs) or per job. For this workflow, the jobs only need to read repository contents and use artifacts; they do not push or modify GitHub resources, so read-only contents (and default read for others) is sufficient.

The single best fix without changing functionality is to add a workflow-level permissions block just after the on: section, with contents: read. This will apply to both check-permissions and e2e-current since neither defines their own permissions, and it directly addresses the CodeQL warning on e2e-current (line 23) by constraining GITHUB_TOKEN. Concretely, edit .github/workflows/e2e-site.yaml to insert:

permissions:
  contents: read

between the on: block (lines 3–9) and the jobs: block (line 11). No additional imports or methods are needed because this is purely a YAML configuration change for GitHub Actions.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses code scanning alert #12 by explicitly constraining the default GITHUB_TOKEN permissions in the E2E site GitHub Actions workflow.

Changes:

• Add a workflow-level permissions block to limit contents access to read-only.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.