ci: Add missing contents: read permission for checkout

[mtrezza]

Summary

Add missing contents: read permission to jobs that deploy to GitHub Pages.

When a job declares an explicit permissions: block, all default permissions are revoked. The actions/checkout action requires contents: read to access the repository. Without it, checkout may fail in private repos or when the token is used for authenticated operations.

Changes

• Add contents: read to permissions in release-automated.yml (docs-publish job)
• Add contents: read to permissions in release-manual-docs.yml (docs-publish job)

Summary by CodeRabbit

• Chores
  • Updated GitHub Actions workflows to refine permissions for documentation publishing and release processes.

[parse-github-assistant]

🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review.

Tip

• Keep pull requests small. Large PRs will be rejected. Break complex features into smaller, incremental PRs.
• Use Test Driven Development. Write failing tests before implementing functionality. Ensure tests pass.
• Group code into logical blocks. Add a short comment before each block to explain its purpose.
• We offer conceptual guidance. Coding is up to you. PRs must be merge-ready for human review.
• Our review focuses on concept, not quality. PRs with code issues will be rejected. Use an AI agent.
• Human review time is precious. Avoid review ping-pong. Inspect and test your AI-generated code.

Note

Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect.

Caution

Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c021a776-15b6-4629-925b-22b434c0271e

📥 Commits

Reviewing files that changed from the base of the PR and between 39c07f1 and 4178ef6.

📒 Files selected for processing (2)

• .github/workflows/release-automated.yml
• .github/workflows/release-manual-docs.yml

---

📝 Walkthrough

Walkthrough

Two GitHub workflow files were updated to add read permissions for the contents scope to their docs-publish jobs during automated and manual documentation release processes.

Changes

Cohort / File(s)	Summary
GitHub Workflow Permission Updates .github/workflows/release-automated.yml, .github/workflows/release-manual-docs.yml	Added contents: read permission to the docs-publish job in both workflows, extending the access scope available during documentation publishing operations.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description includes a clear summary of the changes and the rationale, but does not follow the repository's required template structure with sections like 'Issue Description', 'Approach', and 'TODOs before merging'.	Restructure the description to match the repository template, including Issue Description (with Closes: #XXX), Approach, and TODOs sections, or confirm if the template is optional for this PR type.
Engage In Review Feedback	❓ Inconclusive	Cannot verify PR author engagement with review feedback without access to GitHub PR comments and discussion threads.	Provide GitHub PR review comments, discussion threads, or explicit confirmation that the PR has no reviews yet to properly assess this check.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title begins with the required 'ci:' prefix and clearly describes the main change: adding the missing contents: read permission for checkout in CI workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Security Check	✅ Passed	The changes add necessary contents: read permission to GitHub workflow jobs using actions/checkout, following least privilege principles with minimal scoped permissions and no exposed credentials.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 actionlint (1.7.12)

.github/workflows/release-automated.yml

could not read ".github/workflows/release-automated.yml": open .github/workflows/release-automated.yml: no such file or directory

.github/workflows/release-manual-docs.yml

could not read ".github/workflows/release-manual-docs.yml": open .github/workflows/release-manual-docs.yml: no such file or directory

🔧 YAMLlint (1.38.0)

.github/workflows/release-automated.yml

[Errno 2] No such file or directory: '.github/workflows/release-automated.yml'

.github/workflows/release-manual-docs.yml

[Errno 2] No such file or directory: '.github/workflows/release-manual-docs.yml'

🔧 Checkov (3.2.513)

.github/workflows/release-automated.yml

2026-04-04 18:57:16,569 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 18:57:16,580 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 18:57:16,629 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml
2026-04-04 18:57:16,633 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with .github/workflows/release-automated.yml
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)

... [truncated 9249 characters] ...

cess file .github/workflows/release-automated.yml
2026-04-04 18:57:16,754 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: '.github/workflows/release-automated.yml'

.github/workflows/release-manual-docs.yml

2026-04-04 18:57:16,569 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 18:57:16,581 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 18:57:16,655 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml
2026-04-04 18:57:16,697 [MainThread ] [ERROR] Failed to invoke function /usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner. with .github/workflows/release-manual-docs.yml
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 88, in func_wrapper
result = original_func(item)
^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/object_runner.py", line 74, in
results = parallel_runner.run_function(lambda f: (f, self._parse_file(f)), files_to_load)

... [truncated 9283 characters] ...

file .github/workflows/release-manual-docs.yml
2026-04-04 18:57:16,754 [MainThread ] [ERROR] Exception traceback:
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/checkov/main.py", line 647, in run
self.scan_reports = runner_registry.run(
^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/checkov/common/runners/runner_registry.py", line 177, in run
for result in parallel_runner_results:
File "/usr/local/lib/python3.11/dist-packages/checkov/common/parallelizer/parallel_runner.py", line 118, in _run_function_multiprocess_fork
raise v.internal_exception.with_traceback(v.internal_exception.traceback)
FileNotFoundError: [Errno 2] No such file or directory: '.github/workflows/release-manual-docs.yml'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}