[BUILD]: Add least privilege principle to build workflow

[MacOS]

This PR adds the least privilege principle to the build.yml workflow by setting all permissions to none at the workflow level, and then adding the permission for contents to read for the ``test´` job (#898).

The OpenSSF Score should increase after this PR has been merged.

[Copilot]

Pull request overview

This PR updates the GitHub Actions build workflow to follow least-privilege by defaulting GITHUB_TOKEN permissions to none at the workflow level, then re-enabling only the required permission(s) for specific jobs to improve OpenSSF Scorecard results.

Changes:

• Set workflow-level permissions: {} (no default token permissions).
• Add job-level permissions: contents: read to the test job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (4)

.github/workflows/build.yml:114

• Same as the test job: this job uses actions/cache, but its permissions only grant contents: read. Add actions: write so cache save/update can work. This also removes the stray whitespace-only line under the permissions block.

    permissions:
      contents: read
      

.github/workflows/build.yml:113

• The PR description says contents: read is added only for the test job, but the workflow also grants it to assemble. Either update the PR description to match the actual change, or clarify that both jobs need repo read access for actions/checkout.

    permissions:
      contents: read

.github/workflows/build.yml:45

• actions/cache needs the actions permission to save/update caches. With workflow-level permissions: {} and job-level permissions only granting contents: read, the cache step will be unable to write caches (and may fail or degrade CI performance). Add actions: write (or at least actions: read if you intentionally only want restores) to this job’s permissions.

This issue also appears on line 112 of the same file.

    permissions:
      contents: read

.github/workflows/build.yml:14

• Minor: the comment # Set all permissions to none can be misleading since this config specifically sets the default GITHUB_TOKEN permissions to none at the workflow level (job overrides follow). Consider rewording to make it explicit what is being limited.

# Set all permissions to none
permissions: {}

[michalharakal]

Thank you @MacOS