Potential fix for code scanning alert no. 5: Workflow does not contain permissions

[tndata]

Potential fix for https://github.com/tndata/CodingAgentExplorer/security/code-scanning/5

In general, this problem is fixed by explicitly declaring a permissions block in the workflow (either at the top level or per job) that grants only the minimal scopes required. For a build-and-analysis workflow that only checks out code and runs SonarQube analysis using a secret token, contents: read is usually sufficient, since it only needs to read repository contents and does not write to GitHub.

The best fix here without changing existing functionality is to add a permissions block to the build job (or at the workflow root) that sets contents: read. This aligns with the CodeQL suggestion and the principle of least privilege. Concretely, in .github/workflows/build.yml, under the jobs: → build: job definition (around line 9), add:

    permissions:
      contents: read

This will restrict the GITHUB_TOKEN used in this job to read-only access to repository contents, which is sufficient for actions/checkout and does not interfere with SonarQube, which uses secrets.SONAR_TOKEN. No additional imports or method changes are required; only the YAML configuration is updated.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.