[aristarkhovNV]

Summary

• Add permissions: contents: read to the jobs flagged by code-scanning rule actions/missing-workflow-permissions.
• None of these jobs use GITHUB_TOKEN beyond reading the repo; jobs that need more already declare their own permissions.

Code scanning alerts resolved

Alert	Workflow	Job
#19	build-ubuntu.yml	test-viz-sanitizers
#28	build-ubuntu.yml	build-ubuntu
#42	build-windows.yml	build-windows
#48	build-ubuntu.yml	test-viz-gpu
#49	build-ubuntu.yml	test-cloudxr
#50	build-ubuntu.yml	test-teleop-ros2
#51	pre-commit.yaml	pre-commit

Test plan

• CI passes on this PR
• Code-scanning alerts close after merge

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: NVIDIA/IsaacCapture
• Branch: aaristarkhov/workflow-permissions
• File: .coderabbit.yaml
• Commit: 508f65d
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 193d9cad-bc38-4197-8653-dae9c235d637

📥 Commits

Reviewing files that changed from the base of the PR and between 5154984 and 508f65d.

📒 Files selected for processing: 3

• .github/workflows/build-ubuntu.yml
• .github/workflows/build-windows.yml
• .github/workflows/pre-commit.yaml

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Walkthrough

Seven jobs across three GitHub Actions workflows now explicitly set the contents permission to read. The pre-commit job adds an explicit permissions block.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 508f6

The workflow permission changes are limited to necessary read-only access and present no merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding explicit read-only contents permissions to CI workflow jobs.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}