Potential fix for code scanning alert no. 4: Workflow does not contain permissions

[Rashed-alothman]

Potential fix for https://github.com/Rashed-alothman/TMS/security/code-scanning/4

In general, to fix this type of issue you explicitly declare a permissions: block either at the workflow root (to apply to all jobs without their own block) or per job, granting only the scopes required. Since none of the shown jobs perform write operations via GitHub’s API, they can safely operate with contents: read (the minimal suggested by CodeQL), which still allows actions/checkout and artifact upload actions to function.

The best fix here without changing functionality is to add a top‑level permissions: block right after the name: or on: section in .github/workflows/ci.yml, setting contents: read. This will apply to all jobs (test, code-quality, security, and docker) and limits the default GITHUB_TOKEN permissions they receive. No other code changes or imports are required, and no step in the provided snippet depends on broader permissions. If in the future a job needs additional privileges (for example, to comment on PRs), a more permissive permissions: block can be added to that specific job.

Concretely: in .github/workflows/ci.yml, between the name: TMS CI Pipeline line and the on: block (or just below on:), insert:

permissions:
  contents: read

This resolves the CodeQL warning while maintaining all existing behavior.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.