Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[ismailtsdln]

Potential fix for https://github.com/offsec-toolkit/socialrecon/security/code-scanning/1

In general, the fix is to explicitly declare minimal GITHUB_TOKEN permissions for the workflow or job using a permissions: block. For a CI/test/lint pipeline that only checks out code, runs Go tooling, caches dependencies, and uploads coverage to Codecov, read access to repository contents is sufficient; no write permissions are required.

The best fix here is to add a workflow-level permissions block so it applies to all jobs (there is only ci in the snippet). Place it near the top of .github/workflows/go.yml, after the name: and on: sections, with contents: read as a safe minimal starting point. No changes to the steps or actions are required, and no additional methods or imports are needed because this is YAML configuration only.

Concretely, in .github/workflows/go.yml, between the on: section (lines 3–7) and jobs: (line 9), insert:

permissions:
  contents: read

This constrains the GITHUB_TOKEN to read-only repository contents for this workflow, satisfying the CodeQL rule while preserving existing functionality.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.