From cc95782056ddf0371af7246b70bd0ef09ea8797a Mon Sep 17 00:00:00 2001
From: samatstarion <s.gerene@stariongroup.eu>
Date: Sun, 5 Jul 2026 16:53:45 +0200
Subject: [PATCH] [Fix] scope GitHub Actions write permissions to the
 build-test job (SonarCloud S8233)

---
 .github/workflows/CodeQuality.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/CodeQuality.yml b/.github/workflows/CodeQuality.yml
index d65bfb7..53ca95b 100644
--- a/.github/workflows/CodeQuality.yml
+++ b/.github/workflows/CodeQuality.yml
@@ -7,8 +7,6 @@ on:
 
 permissions:
   contents: read
-  checks: write          # dorny/test-reporter check run + annotations
-  pull-requests: write   # sticky coverage comment
 
 jobs:
   # SonarCloud analysis. Kept as a single instance on a single OS: running
@@ -61,6 +59,10 @@ jobs:
   # Needs no secrets, so it also produces signal on fork PRs (where SONAR_TOKEN is absent).
   build-test:
     name: Build & Test (${{ matrix.os }})
+    permissions:
+      contents: read
+      checks: write          # dorny/test-reporter check run + annotations
+      pull-requests: write   # sticky coverage comment
     strategy:
       fail-fast: false
       matrix: