qunitjs / eslint-plugin-qunit / 29261380583

95%

push

github

ci: set top-level contents: read permissions (#688)

## Summary

Workflows should declare least-privilege token scopes explicitly.
Top-level `contents: read` is enough for checkout and Coveralls (which
uses the provided `GITHUB_TOKEN`); widen per-job only if something
fails.

- Add top-level `permissions: contents: read`.

## Related PRs

- #686: push only on main
- #687: concurrency / cancel-in-progress
- **This PR**: `contents: read`
- #689: npm cache + Node matrix + ESLint 10 gate
- #690: ESLint 8.38 peer smoke

## Test plan

- [ ] CI jobs complete successfully
- [ ] Coveralls parallel upload still succeeds

Co-authored-by: Cursor <cursoragent@cursor.com>

837 of 922 branches covered (90.78%)

Branch coverage included in aggregate %.

997 of 1071 relevant lines covered (93.09%)

303.91 hits per line