Update build-and-deploy.yml

[JoeDibley]

Main to dev merge

To fix the problem, add an explicit permissions block to the determine-environment job, granting it the minimal possible permissions to execute its function. Since this job does not interact with repository contents, issues, or pull requests—and merely determines the environment by reading workflow inputs—it should only require read access to repository contents, or even less if possible. The most minimal and future-proof approach is to set all permissions to none, unless "contents: read" is strictly necessary (for example, if the job or future steps might require reading code). We can add:

permissions:
  contents: read

or, to further restrict:

permissions:
  contents: none

For now, "contents: read" is a safe minimal choice that will satisfy CodeQL, in line with other jobs’ minimal permissions.

Edit the .github/workflows/build-and-deploy.yml file by adding the permissions block right under runs-on: ubuntu-latest for the determine-environment job (line 21).

To fix the reported issue, explicitly add a permissions: block to the deploy job in .github/workflows/build-and-deploy.yml. The job does not take any actions that require write permissions on the repository; it merely downloads artifacts, interacts with Azure, and displays output. As such, the least-privilege permissions for this job are contents: read, which allows the job to download artifacts but not modify repository contents. Add the following to the deploy job, just after runs-on: ubuntu-latest and before needs::

permissions:
  contents: read

This mirrors the explicit permissions block in the build job and ensures compliance with least privilege recommendations.

---