ci: set least-privilege workflow permissions

[robnester-rh]

What

Add an explicit least-privilege permissions: block (contents: read) to
this workflow.

Why

Follow-up to EC-2145 (conforma org default workflow permissions set to
read). This workflow had no permissions: block and relied on the implicit
default token. contents: read is the only scope it needs (actions/checkout);
uploads and test steps require no GITHUB_TOKEN scopes. Scoping it explicitly
follows least-privilege and addresses the review feedback that read-all is
broader than necessary.

Co-Authored-By: Claude noreply@anthropic.com
Ref: EC-2171

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 7b53e022-61a2-4dcc-bed3-f3222ae1d4ad

📥 Commits

Reviewing files that changed from the base of the PR and between e8c75c3 and f39e042.

📒 Files selected for processing (1)

• .github/workflows/shellspec.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The ShellSpec GitHub Actions workflow now explicitly grants read-only access to repository contents.

Changes

ShellSpec workflow permissions

Layer / File(s)	Summary
Configure workflow content access .github/workflows/shellspec.yaml	The workflow defines read permission for repository contents.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to f39e0

The workflow now uses an explicit read-only repository permission for its checkout step. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: setting least-privilege permissions for the CI workflow.
Description check	✅ Passed	The description directly explains the addition of explicit contents: read permissions and its least-privilege purpose.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Set least-privilege permissions for ShellSpec workflow

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Grants the ShellSpec workflow read-only repository contents access.
• Makes token scope explicit and independent of organization defaults.

High-Level Assessment

The explicit workflow-level contents: read permission is the appropriate least-privilege approach because both jobs only need repository checkout access. Broader read-all permissions or relying on organization defaults would grant unnecessary or implicit access.

Files changed (1) +2 / -0

Other (1) +2 / -0

shellspec.yamlRestrict workflow token to read-only contents access +2/-0

Restrict workflow token to read-only contents access

• Adds an explicit workflow-level 'permissions' block granting only 'contents: read'. This supports 'actions/checkout' while avoiding unnecessary token scopes and reliance on organization defaults.

.github/workflows/shellspec.yaml

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗