Live Share SDK 2.0.0

[huntj88]

No description provided.

To fix the issue, add a permissions block with least-privilege required by the workflow. As all current steps only read repository contents and never write to them (e.g., no pushes, PR creation, artifact upload), the minimal needed permission is for reading repository contents (contents: read).

The CodeQL warning suggests placing the permissions block either at the workflow root or inside the job. Adding it at the root ensures it applies to all jobs (present and future) unless overridden.

Edit the file .github/workflows/live-share-build-samples.yaml, and add the following block near the top, after the name: field and before/until jobs:. Ensure proper indentation and spacing. No new imports or methods are needed.

---

To fix the problem, add a permissions block to the workflow YAML to explicitly restrict the privileges granted to the GitHub Actions jobs. The block can be set either at the root (applies to all jobs) or inside each job. The best practice is to set the minimum permissions needed; for most formatting checks and “checkout”/read operations, contents: read is sufficient.

• Add the following block 'permissions:\n contents: read' right after the name: line (global) or inside the jobs/build: job (per-job).
• Since all steps shown only read files, run bash scripts, and do not publish or modify repo contents, contents: read is appropriate.
• No changes to imports, extra method definitions, or downstream workflow content are needed.

---

To fix the problem, we need to add a permissions: block specifying the least required privileges for the workflow. As all steps only need access to repository contents, the recommended setting is contents: read. This should be added near the top of the workflow file—directly after name: and before on:, so that it applies to the entire workflow (and therefore, all jobs within it). No code functionality is changed; just the permissions granted to the workflow's GITHUB_TOKEN. No imports or additional definitions are required.

To resolve this issue, you should add an explicit permissions block to the workflow (or to the relevant job, if you want finer control). In this workflow, the safest minimal permissions can be set with contents: read, which allows jobs to check out code but not to write to repository contents. Insert the permissions block either at the root of the workflow file (to apply to all jobs), or just under the build: job definition. The recommended convention is to apply this at the top level, immediately after the name: and before the on: block. No imports or external dependencies are needed; this is a one-line YAML edit.