CodeQL flagged the new static-analysis job for relying on the repository's
default GITHUB_TOKEN scope. Fair, and the repo already holds the opposite
opinion elsewhere: build.yml's release job spells out contents: write with a
comment saying the token's reach should be visible at the point of use.
Set at workflow level rather than on the one job that was flagged, because none
of these four write anything -- they read the code, build it and attach reports.
It also means a repository default that widens later cannot quietly widen these
jobs with it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
JMR-devandClaude Opus 5
8727fccba1