Potential fix for code scanning alert no. 4: Workflow does not contain permissions

[majorsilence]

Potential fix for https://github.com/TownSuite/DapperExtras/security/code-scanning/4

In general, the problem is fixed by adding an explicit permissions: block to the workflow or to each job, granting only the minimum required scopes for GITHUB_TOKEN. For a simple CI workflow that only checks out code, builds, runs tests, and uploads artifacts—and does not push changes or modify issues/PRs—contents: read is typically sufficient.

The best fix here, without changing behavior, is to add a root-level permissions: block that applies to all jobs in this workflow. Since the only GitHub operations are actions/checkout and actions/upload-artifact, the token only needs read access to repository contents; artifact upload does not require additional repository write scopes. We will therefore insert:

permissions:
  contents: read

between the on: section and the jobs: section in .github/workflows/dotnet.yml. No imports or other definitions are needed, and no existing steps or job definitions need to change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

Adds an explicit permissions block to the .NET CI workflow to address the code scanning alert about missing GITHUB_TOKEN permission scoping, aligning the workflow with least-privilege defaults.

Changes:

• Add root-level permissions: contents: read to .github/workflows/dotnet.yml so all jobs inherit minimal token permissions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.