Harden Actions workflow token scope by setting explicit minimal permissions

[Copilot]

• Security hardening (GitHub Actions)

  • Added an explicit workflow-level permissions block in .github/workflows/build.yml.
  • Set token scope to read-only for repository contents.

• Result

  • Resolves CodeQL alert actions/missing-workflow-permissions with a minimal, targeted workflow change.

permissions:
  contents: read

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.83%. Comparing base (27a5f17) to head (2c16617).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #59   +/-   ##
=======================================
  Coverage   76.83%   76.83%           
=======================================
  Files          28       28           
  Lines        1161     1161           
=======================================
  Hits          892      892           
  Misses        218      218           
  Partials       51       51           

Flag	Coverage Δ
unittests	76.83% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR hardens the GitHub Actions build workflow by explicitly setting minimal GITHUB_TOKEN permissions at the workflow level, aligning the workflow with least-privilege expectations and addressing the actions/missing-workflow-permissions class of CodeQL findings.

Changes:

• Added an explicit workflow-level permissions block.
• Constrained GITHUB_TOKEN to read-only access for repository contents (contents: read).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.