Restore checkout access in CI jobs by adding explicit contents: read permissions

[Copilot]

The build-docker-images (ubuntu, 5.0) workflow job failed at repository checkout because job-level permissions omitted repository read access. This PR adds explicit read permission for repository contents where checkout is used.

• Root cause

  • Job-level permissions blocks in main.yml overrode default token scopes.
  • actions/checkout then failed with missing credentials to fetch source.

• Changes

  • Added contents: read under permissions for:
    • build-docker-images
    • pre-commit
    • unit-tests
  • No workflow logic or execution flow changed; only token scope was corrected.

• Snippet

  permissions:
    contents: read
    statuses: write

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/hadolint/hadolint/releases/latest
  • Triggering command: /usr/bin/curl curl -L --connect-timeout 5 --fail --silent REDACTED (http block)
• www.schemastore.org
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/.npm/_npx/8907b2ae4ba29768/node_modules/.bin/v8r .github/workflows/main.yml (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)