Per Copilot:

To fix the problem, explicitly declare a permissions block so that the GITHUB_TOKEN is limited to the minimal rights required. Since this workflow only checks out code and builds/tests it, it only needs read access to repository contents; no job appears to require write permissions or access to other scopes (issues, pull requests, packages, etc.).

The most straightforward fix that doesn’t alter existing behavior is to add a single, workflow-wide permissions block at the top level (same indentation as on: and jobs:) and set contents: read. This applies to all jobs that don’t override permissions, covering macos, ubuntu, and distcheck in one place. Concretely, in .github/workflows/builds.yaml, insert:

permissions:
  contents: read

between the on: [pull_request] line and the jobs: line. No additional imports, methods, or other changes are required.

Signed-off-by: Ralph Castain <rhc@pmix.org>