chore(release): 1.0.0

[metalboyrick]

No description provided.

In general, the fix is to explicitly declare a permissions: block in the workflow (either at the root or per job) that grants only the scopes required. This prevents the workflow from inheriting overly broad default token permissions and documents exactly what the workflow needs.

For this specific workflow, the version-bump-create-auco job pushes commits and tags to the main branch using git, which requires repository contents write access. Even though it uses secrets.ORG_GITHUB_TOKEN, it is still best practice to constrain the GITHUB_TOKEN as well. The check_commit job only reads commit messages and does not need write access, so read-only is sufficient there. The simplest, least-disruptive change is to add a root-level permissions: block applying to all jobs, granting contents: write (so any job that might need to write can do so) and defaulting other scopes to none. This avoids any behavior change beyond what is already implicitly allowed by the current defaults, while documenting and constraining the scope.

Concretely, edit .github/workflows/release-create-auco.yaml and insert a permissions: section just after the name: declaration and before the on: block:

name: Version Bump and Publish Create Auco
permissions:
  contents: write

on:
  pull_request:
    ...

No additional methods, imports, or external definitions are needed; this is purely a YAML workflow configuration change.

In general, the fix is to add an explicit permissions: block to the workflow (either at the top level or per job) that grants only the minimal permissions needed. Since this workflow uses a separate personal/organization token for git pushes and relies on npm and Slack secrets for external operations, the GITHUB_TOKEN itself does not appear to require any write permissions. The safest minimal set is contents: read, which allows checkout and reading repository contents but not writing to them via GitHub APIs.

The best fix without changing functionality is to add a root-level permissions: block just under the name: (and before on:), so that it applies to both check_commit and version-bump-create-auco jobs. This will satisfy CodeQL and document the intended token scope. No new imports, methods, or other definitions are needed, as this is purely a workflow configuration change.

Concretely, in .github/workflows/release-create-auco.yaml, add:

permissions:
  contents: read

between the existing line 1 (name: ...) and line 3 (on:). No other lines need to be modified.