Potential fix for code scanning alert no. 7: Workflow does not contain permissions

[dmetzner]

Potential fix for https://github.com/Catrobat/Catroweb/security/code-scanning/7

In general, the fix is to add an explicit permissions block to the workflow (at the top level or within the specific job) and restrict the GITHUB_TOKEN to the minimal scopes required. This prevents the workflow from inheriting overly broad default repository/organization permissions.

For this workflow, the deploy-swagger-ui job needs to push generated static files to GitHub Pages via peaceiris/actions-gh-pages@v4, which requires write access to repository contents. The simplest, least-disruptive fix is to add a job-level permissions block under deploy-swagger-ui specifying contents: write. This both satisfies the CodeQL requirement and documents clearly what the token can do. No other permissions (issues, pull requests, etc.) are required based on the shown steps, so they should not be granted.

Concretely, in .github/workflows/deploy_api_spec.yaml, under jobs: > deploy-swagger-ui:, insert:

    permissions:
      contents: write

indented to match runs-on. No additional imports, methods, or external definitions are needed because this is a pure YAML configuration change within the existing workflow file.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.01%. Comparing base (676aa4e) to head (556cc1b).
⚠️ Report is 5 commits behind head on develop.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #6128   +/-   ##
==========================================
  Coverage      50.00%   50.01%           
  Complexity      7481     7481           
==========================================
  Files            722      722           
  Lines          24100    24100           
==========================================
+ Hits           12051    12053    +2     
+ Misses         12049    12047    -2     

Flag	Coverage Δ
behat	47.70% <ø> (+<0.01%)	⬆️
phpunit	10.18% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.