ci(security): restrict GITHUB_TOKEN permissions in update-plugins workflow

[JohnMcLear]

Summary

Addresses CodeQL code-scanning alert #115 — "Workflow does not contain permissions".

update-plugins.yml was the only workflow without an explicit permissions: block; all the others already scope the default GITHUB_TOKEN down. The cross-repo work (cloning ether/ep_* repos, pushing updates, merging Dependabot PRs) is authenticated via secrets.PLUGINS_PAT, so the default GITHUB_TOKEN only needs contents: read for actions/checkout.

Test plan

• Lint diff is 6 added lines of YAML; no other files change
• Next scheduled run still succeeds (actions/checkout, pnpm install, and the PAT-authenticated git/gh calls all work under contents: read)

🤖 Generated with Claude Code

[qodo-free-for-open-source-projects]

Review Summary by Qodo

Restrict GITHUB_TOKEN permissions in update-plugins workflow

✨ Enhancement

Walkthroughs

Description

• Adds explicit permissions block to update-plugins workflow
• Restricts GITHUB_TOKEN to read-only access for contents
• Addresses CodeQL code-scanning alert #115
• Aligns with security best practices across workflows

Diagram

flowchart LR
  A["update-plugins.yml<br/>workflow"] -->|"add permissions block"| B["GITHUB_TOKEN<br/>contents: read"]
  C["secrets.PLUGINS_PAT"] -->|"authenticates"| D["cross-repo operations<br/>clone, push, merge"]
  B -->|"enables"| E["actions/checkout"]

Loading

File Changes

1. .github/workflows/update-plugins.yml Security +6/-0

Add explicit GITHUB_TOKEN permissions block

• Adds explicit permissions: block with contents: read scope
• Includes explanatory comment about PLUGINS_PAT authentication
• Restricts default GITHUB_TOKEN to minimum required permissions
• Resolves CodeQL security scanning alert #115

.github/workflows/update-plugins.yml

---

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

ⓘ The new review experience is currently in Beta. Learn more