add reusable workflow

[arnaudbossobita]

No description provided.

To fix the problem, explicitly declare a permissions block so that the GITHUB_TOKEN used in this workflow has only the minimal rights it needs. Since none of the jobs perform operations that modify the repository (such as pushing commits, creating releases, or managing issues/PRs), the minimal and sufficient permission is contents: read. Placing this permissions block at the root of the workflow ensures it applies to all jobs unless they override it.

Concretely, in .github/workflows/ci-with-step.yml, add a top-level permissions: section right under the name: CI line (before on:). The block should read:

permissions:
  contents: read

No changes are needed inside the individual jobs. No additional imports or actions are required; this change only adjusts the workflow’s static YAML configuration and does not alter the functional behavior of the build and deployments.

In general, the fix is to explicitly declare a permissions: block instead of relying on the repository’s default GITHUB_TOKEN permissions. Since all three jobs only need to read the repository to run and upload/download artifacts (which do not require elevated repo scopes), we can safely set contents: read at the workflow root, applying to all jobs.

The best minimal fix without changing functionality is:

• Add a top-level permissions: block after the name: (or after on:) setting contents: read.
• There is no evidence any job needs write permissions to issues, pull requests, or contents, so we do not grant them.

Concretely, in .github/workflows/ci-with-step.yml, between line 2 and line 3 (or equivalently between the existing name: CI and on:), add:

permissions:
  contents: read

No imports or additional definitions are needed, as this is purely a YAML workflow configuration change.

In general, the fix is to add an explicit permissions: block that grants only the minimum GitHub token permissions required. Since this workflow only checks out code, runs tests, builds, and uploads/downloads artifacts, it doesn’t need any write permission to the repository; a read-only token is sufficient, and in this specific case we can even set all permissions to none if the workflow doesn’t require the token at all.

The single best minimal fix here is to add a permissions block at the root of the workflow (applies to all jobs) and set contents: read, which is a safe, common default for workflows that only need to read the repository. This both satisfies CodeQL’s requirement for an explicit permissions block and adheres to least privilege, while not breaking actions/checkout, which can operate with contents: read. No imports or additional methods are needed, only a small YAML change near the top of .github/workflows/ci-with-step.yml.

Concretely: edit .github/workflows/ci-with-step.yml to insert a permissions: section after the name: CI (line 1) and before the on: block (line 3). The rest of the workflow remains unchanged.