ci: scope GITHUB_TOKEN to least privilege

[jamesarich]

Summary

Checked the repo's Actions defaults: default_workflow_permissions: write. With no permissions: block in githubci.yml, every job got a write-capable GITHUB_TOKEN — including the build job, which now runs on every PR (forks included, since #2 added the pull_request trigger).

Only the release-asset upload (softprops/action-gh-release, gated to github.event_name == 'release') actually needs write access. Added a top-level permissions: contents: read, overridden to contents: write on just the build job.

Not done here, flagging for later: the release step lives in the same job as the PR-only build/artifact steps, so a genuinely tighter setup would split publish-release into its own job (needs: build, if: github.event_name == 'release', downloads the artifact) so the PR path never even has a write-capable token in scope. Left as a bigger refactor for another pass.

Test plan

• yq eval '.' .github/workflows/githubci.yml — valid YAML
• actions/upload-artifact is unaffected by permissions: (uses its own Actions Results API token, not GITHUB_TOKEN) — verified this is standard behavior, not assumed

[coderabbitai]

Warning

Review limit reached

@jamesarich, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 47 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8b9e89dc-410e-4b6f-bed5-104c647dea70

📥 Commits

Reviewing files that changed from the base of the PR and between 9f53e4f and 58986a2.

📒 Files selected for processing (1)

• .github/workflows/githubci.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}