[robertodr]

🤖 AI text below 🤖

Summary

GitHub code scanning reports 14 open actions/missing-workflow-permissions alerts: the deploy, lint, nix, qa-analysis and test workflows don't limit the GITHUB_TOKEN, so it gets the repository default permissions. This sets a workflow-level permissions: contents: read in each of them.

Jobs that already declare their own permissions (the PyPI upload and release asset jobs in deploy.yml, the sanitizer and clang-tidy jobs in qa-analysis.yml) keep them, since job-level blocks override the workflow-level one.

Changes

• Add permissions: contents: read to deploy.yml, lint.yml, nix.yml, qa-analysis.yml and test.yml.

Checklist

• Tests added or updated to cover the changes
• Documentation updated (docstrings, docs/, CONTRIBUTING.md) if needed
• CHANGELOG / release notes updated if applicable

Not applicable: CI configuration only. Please check that the SonarQube job still works on PRs, as it may need pull-requests: read.

AI/LLM disclosure

• I did not use LLM tooling, or used it only privately for ideation
• I used the following tool to help write this PR description: Pi (claude-opus-4.8)
• I used the following tool to generate or modify code: Pi (claude-opus-4.8)

Summary by CodeRabbit

• Chores
  • Deployment, linting, Nix, QA analysis, and test automation workflows now have read-only access to repository contents unless a workflow defines its own permissions.
  • These updates affect repository automation; they do not change application features or behavior. Users will not see any changes in the product.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: 654d54cd-6d3d-4687-b8f2-10c2de8b8f6f

📥 Commits

Reviewing files that changed from the base of the PR and between d741122 and 11af6cd.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: 1d84f9e7-484d-4350-822b-02f13509534e

📥 Commits

Reviewing files that changed from the base of the PR and between 794f239 and 69db5a1.

📒 Files selected for processing: 5

• .github/workflows/deploy.yml
• .github/workflows/lint.yml
• .github/workflows/nix.yml
• .github/workflows/qa-analysis.yml
• .github/workflows/test.yml

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

Five GitHub Actions workflows now declare workflow-level contents: read permissions. In the deploy workflow, jobs with their own permission declarations retain those settings.

Changes: Workflow Token Permissions

Layer / File(s)	Summary
Declare contents read permissions .github/workflows/deploy.yml, .github/workflows/lint.yml, .github/workflows/nix.yml, .github/workflows/qa-analysis.yml, .github/workflows/test.yml	Each workflow declares workflow-level contents: read permissions. Deploy jobs with their own permission declarations retain those settings.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 69db5

No actionable workflow failure is established from the new read-only token defaults. The change is ready for normal CI validation.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: limiting GITHUB_TOKEN permissions in CI workflows.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (5 skipped: 5 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Docs preview: https://pr-422.monoprop-docs.pages.dev

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.99%. Comparing base (35b4c35) to head (11af6cd).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #422   +/-   ##
=======================================
  Coverage   97.99%   97.99%           
=======================================
  Files          14       14           
  Lines         797      797           
  Branches      111      111           
=======================================
  Hits          781      781           
  Misses         11       11           
  Partials        5        5           

Flag	Coverage Δ
cpp	97.99% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud