Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[Edvin N (nissessenap)]

Potential fix for https://github.com/annotell/kognic-auth-python/security/code-scanning/2

In general, this issue is fixed by adding an explicit permissions: block to the workflow or to individual jobs, minimizing the scopes to what the workflow actually needs. For a typical lint/test-only workflow that just checks out code and runs local tools, contents: read is sufficient and recommended.

For this specific file (.github/workflows/python-package.yml), the simplest and best fix without changing functionality is to add a workflow-level permissions: block just after the name: line. Both lint and build jobs only need to read the repository contents; they do not push commits, create releases, or modify issues/PRs. Therefore, permissions: contents: read is adequate. No additional methods, imports, or definitions are required because this is pure workflow configuration.

Concretely:

• Edit .github/workflows/python-package.yml.
• Insert:

permissions:
  contents: read

between the name: Python package line and the on: block. This applies the restriction to all jobs in the workflow, satisfying CodeQL and adhering to least privilege.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.