cherry-pick 1b0413ee

.github/workflows/copilot-setup-steps.yml

@@ -16,6 +16,14 @@ jobs:
   copilot-setup-steps:
     runs-on: ubuntu-latest
 
+    # Set the permissions to the lowest permissions possible needed for your steps.
+    # Copilot will be given its own token for its operations.
+    permissions:
+      # If you want to clone the repository as part of your setup steps, for example to install dependencies,
+      # you'll need the `contents: read` permission. If you don't clone the repository in your setup steps,
+      # Copilot will do this for you automatically after the steps complete.
+      contents: read
+
     # Timeout after 30 minutes (maximum is 59)
     timeout-minutes: 30
 
@@ -23,10 +31,10 @@ jobs:
     # If you do not check out your code, Copilot will do this for you.
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v5
 
       - name: Set up Python 3.11
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v5
         with:
           python-version: '3.11'