Potential fix for code scanning alert no. 97: Workflow does not contain permissions

[Pangjiping]

Potential fix for https://github.com/alibaba/OpenSandbox/security/code-scanning/97

In general, the problem is fixed by adding an explicit permissions block that grants only the minimal required scopes to GITHUB_TOKEN. Since the jobs here only need to check out code and run local builds/tests, they only require read access to repository contents. They do not need to write to the repo, create statuses, or modify issues/PRs.

The best minimal fix without changing existing functionality is to add a workflow‑level permissions block near the top of .github/workflows/egress-test.yaml.yml, immediately after the name: line or after the on: block. Setting permissions: contents: read at the root will apply to both test and smoke jobs, satisfying the CodeQL rule and enforcing least privilege. No imports or additional methods are needed, just the YAML configuration change.

Concretely: in .github/workflows/egress-test.yaml.yml, insert:

permissions:
  contents: read

so that it appears between the on: block and concurrency: (or right after name:), ensuring the entire workflow uses read‑only contents permissions.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[gemini-code-assist]

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

[gemini-code-assist]

Important

Installation incomplete: to start using Gemini Code Assist, please ask the organization owner(s) to visit the Gemini Code Assist Admin Console and sign the Terms of Services.

[hittyt]

Change summary: This PR adds explicit read-only permissions to the egress test workflow, but it is redundant as this fix is already merged in main.

This PR is outdated and redundant. The proposed permissions block was already added to the main branch via PR #278. Additionally, the PR branch lacks recent critical updates found in main, such as the inclusion of components/internal/** in the trigger paths and the upgrade of several GitHub Actions to newer versions. Merging this PR would cause a regression in the CI configuration. Also, the workflow filename .github/workflows/egress-test.yaml.yml contains a double extension typo which should be corrected in a separate chore PR.

[hittyt]

[P1] Redundant and outdated fix

This permissions block has already been added to the main branch (see PR #278). Furthermore, this PR is based on an older version of the workflow and is missing critical recent changes:

1. The components/internal/** path filter.
2. Upgraded GitHub Actions versions (e.g., actions/checkout@v6).

Merging this PR would result in a regression of the workflow configuration. It is recommended to close this PR.