[CLIENT-4350] Add runtime flag /RTC1 to raise an error when uninitialized read occurs

[juliannguyen4]

No description provided.

In general, the fix is to explicitly declare permissions: either at the root of the workflow (applies to all jobs without their own block) or under the specific job, setting it to the minimum needed scopes. For a typical build-and-test workflow that only needs to read source code and, possibly, read packages, contents: read (and optionally packages: read) is sufficient.

For this specific workflow, we should add a root-level permissions: block with least-privilege settings. All shown steps only require reading repository contents. They do not push commits, create releases, modify issues or PRs, or interact with environments that require token writes. Therefore, the safest minimal explicit configuration is:

permissions:
  contents: read

Place this immediately under the on: block (after line 3 or 4), aligned to the same indentation level as on: and jobs:. This ensures all jobs—including windows-python-dbg—inherit these read-only permissions for GITHUB_TOKEN. No imports or additional code structures are needed since this is a YAML workflow configuration change only, and it preserves existing functionality while enforcing least privilege.

In general, the problem is fixed by adding an explicit permissions: block to the workflow or to the specific job so that the GITHUB_TOKEN is limited to the minimum required scope, typically contents: read (and other read scopes if needed). This documents the workflow’s expectations and prevents accidental elevation if repository or organization defaults change.

For this specific workflow, the smallest, least intrusive fix is to add a permissions: block at the root level of .github/workflows/stage-tests.yml, right after the on: definition. That block will apply to all jobs that do not override permissions, including windows-dbg. Since the shown jobs only check out code, run tests, pull Docker images, and use reusable workflows, they only need read access to repository contents; write permissions are not required. Therefore, we can safely set permissions: contents: read globally. No imports or additional methods are needed because this is a YAML configuration change only.

Concretely, in .github/workflows/stage-tests.yml, add:

permissions:
  contents: read

immediately after the on: block (after the workflow_call: configuration). This will satisfy CodeQL’s requirement and enforce least privilege for the GITHUB_TOKEN used by all jobs, including the windows-dbg job that reuses another workflow.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.48%. Comparing base (88dadfa) to head (ee9af6b).
⚠️ Report is 1 commits behind head on dev.

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #990   +/-   ##
=======================================
  Coverage   83.48%   83.48%           
=======================================
  Files          99       99           
  Lines       14402    14402           
=======================================
  Hits        12024    12024           
  Misses       2378     2378           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.