Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[Lawrence Lucas Large (LukeLarge)]

Potential fix for https://github.com/LukeLarge/opentonapi/security/code-scanning/3

The best way to fix this issue is to explicitly define the minimal permissions the workflow needs by adding a permissions block at either the workflow or job level. Since this workflow is likely to open pull requests (according to its name and apparent logic—make update-sdk is likely to include creating a PR), the minimal necessary permissions should be contents: read and pull-requests: write. The optimal way to implement this is to add a permissions: block at the top level, beneath the name field but above jobs, to ensure all jobs inherit the correct permissions. No additional imports or code definitions are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses a code scanning alert by adding a permissions block to the GitHub Actions workflow that creates pull requests for TonAPI SDK updates. While the addition of explicit permissions is a security best practice, the specified permission level is incorrect for the workflow's operations.

• Adds workflow-level permissions block to restrict token access
• Sets contents: read and pull-requests: write permissions

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The contents: read permission is insufficient for this workflow. The make update-sdk command (line 19) performs a git push -u origin update -f operation (see Makefile line 34), which requires write access to the repository contents. The permission should be contents: write instead of contents: read.

Suggested change

	contents: read
	contents: write