Merge upstream

[AlekSi]

No description provided.

To fix the problem, add an explicit permissions block that grants the minimal required scopes to GITHUB_TOKEN. Since this workflow appears to orchestrate tests via a reusable workflow and there is no indication that it needs to write to the repository, pull requests, or other resources, a conservative and safe default is permissions: contents: read at the workflow root. This documents that the workflow is intended to be read-only and prevents it from gaining broader rights if repository/org defaults change later.

Concretely, edit .github/workflows/regress_tests.yml and insert a permissions section near the top-level keys (e.g., after run-name or after on:). Because we cannot see the inner steps and must avoid breaking existing functionality, we should choose a minimal but generally safe set of permissions. The minimal recommended starting point per GitHub’s guidance is contents: read; if the reusable workflow needs more, those can be defined there without changing existing behavior here. No imports or external libraries are involved, only YAML changes.

In general, to fix this class of issue you add an explicit permissions section either at the workflow root (so it applies to all jobs) or per job, and set it to the least privileges required by the workflow steps. For a typical test workflow that only needs to read the repository contents and possibly read packages, contents: read (and optionally packages: read) is an appropriate baseline.

For this specific workflow, the simplest and safest fix without changing existing functionality is to add a top-level permissions block right after the run-name (or before on:) that restricts the GITHUB_TOKEN to repository read access. Since the code we see is only dispatching to a reusable workflow, and there is no evidence here that write access is required, using contents: read is a reasonable minimal starting point and matches GitHub’s own recommendations. This block will apply to both test-pr and test-full, satisfying CodeQL’s requirement and documenting the intended permissions.

Concretely:

• Edit .github/workflows/regress_tests.yml.

• Insert:

  permissions:
    contents: read

  after line 2 (run-name: ...) and before the existing concurrency: key on line 3.

• No imports or other code constructs are required; this is a pure YAML configuration change.

To fix the problem, explicitly declare restricted GITHUB_TOKEN permissions for this workflow or job. Since this is a reusable workflow that checks out code and uploads artifacts, it only needs read access to repository contents; no write operations to the repo or PRs are required.

The best minimal fix is to add a root-level permissions block right under the workflow name: (before on:). This will apply to all jobs in this workflow that do not override permissions. For this workflow, contents: read is sufficient; other scopes (issues, pull-requests, etc.) are not needed based on the provided steps. No imports or additional methods are required because this is just YAML configuration.

Concretely, in .github/workflows/regress_tests_template.yml, insert:

permissions:
  contents: read

on new lines after line 1 (name: Reusable SQL Tests). No other parts of the file need to change.