ci: add least-privilege permissions to workflows (closes 3 CodeQL alerts)

[hlsitechio]

What

Adds a top-level permissions: contents: read block to ci.yml and deploy-web.yml.

Why

CodeQL flags 3 medium actions/missing-workflow-permissions alerts:

• ci.yml:19 (validate job)
• ci.yml:76 (smoke job)
• deploy-web.yml:10 (deploy job)

Without an explicit block, GITHUB_TOKEN inherits the repository's broad default permissions in every job — unnecessary blast radius if any step or dependency is compromised.

Safety

No job in these workflows writes to the repo:

• CI only checks out, builds, and tests.
• The Cloudflare Pages deploy authenticates with its own CLOUDFLARE_API_TOKEN secret, not GITHUB_TOKEN, so read-only access does not affect it.

contents: read is therefore sufficient and behaviour-preserving.

Note

The validate build job is currently red on main for pre-existing reasons (repo is in maintenance mode). That failure is unrelated to this change — verify via the Analyze (actions) CodeQL job, which is what evaluates these three alerts.

🤖 Generated by the unattended daily portfolio review (Fizz, 2026-08-02).

Summary by CodeRabbit

• Chores
  • Improved workflow security by limiting automated repository access to read-only permissions.
  • Applied least-privilege access controls to continuous integration and deployment processes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 3f95a639-9775-429a-88d7-0026352c9308

📥 Commits

Reviewing files that changed from the base of the PR and between 1bb874f and bae699b.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• .github/workflows/deploy-web.yml

---

📝 Walkthrough

Walkthrough

The CI and web deployment workflows now set workflow-level GITHUB_TOKEN permissions to read-only repository contents. The deployment workflow also documents the token usage.

Changes

Workflow Token Permissions

Layer / File(s)	Summary
Configure read-only workflow permissions .github/workflows/ci.yml, .github/workflows/deploy-web.yml	Both workflows set contents: read for GITHUB_TOKEN. The deployment workflow adds comments that document the token usage.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change by identifying least-privilege permissions added to CI workflows and the related CodeQL alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/workflow-least-privilege-permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}