Potential fix for code scanning alert no. 12: Workflow does not contain permissions

[dmetzner]

Potential fix for https://github.com/Catrobat/Catroweb/security/code-scanning/12

In general, this issue is fixed by explicitly declaring a permissions block in the workflow (either at the top level or per job) and restricting the GITHUB_TOKEN to the minimal scopes required. For this deployment workflow, the steps only need to read repository contents to perform a checkout; the deployment itself is done via SSH using secrets, so no write scopes on the GITHUB_TOKEN are necessary.

The best minimal fix without changing existing functionality is to add a workflow-level permissions block directly under the name: Deployment line, setting contents: read. This will apply to all jobs (including deploy) that do not override permissions. No other scopes appear necessary based on the shown code. Concretely, in .github/workflows/deployment.yaml, insert:

permissions:
  contents: read

after line 9 (name: Deployment). No imports or other definitions are needed since this is a YAML configuration change only.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.01%. Comparing base (f2461a4) to head (b7e01f4).
⚠️ Report is 12 commits behind head on develop.

Additional details and impacted files

@@            Coverage Diff             @@
##             develop    #6130   +/-   ##
==========================================
  Coverage      50.00%   50.01%           
  Complexity      7481     7481           
==========================================
  Files            722      722           
  Lines          24100    24100           
==========================================
+ Hits           12051    12053    +2     
+ Misses         12049    12047    -2     

Flag	Coverage Δ
behat	47.70% <ø> (+<0.01%)	⬆️
phpunit	10.18% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.