Fix token permission code scanning alerts #36

	name: Benchmark Go

	on:
	pull_request:
	branches:
	- main

	permissions:
	contents: read

	jobs:
	benchmark:
	name: Performance regression check
	runs-on: ubuntu-latest
	permissions:
	# allow posting comments to pull request
	pull-requests: write

	steps:
	- name: Fetch Repo
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false

	- name: Install Go
	uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.1.0
	with:
	go-version-file: go.mod

	- name: Run benchmark
	run: set -o pipefail; go test ./... -benchmem -run=^$ -bench . \| tee output.txt

	- name: Store benchmark result
	uses: benchmark-action/github-action-benchmark@d48d326b4ca9ba73ca0cd0d59f108f9e02a381c7 # v1.20.4
	with:
	tool: 'go'
	output-file-path: output.txt
	github-token: ${{ secrets.GITHUB_TOKEN }}
	auto-push: false
	alert-threshold: "150%"
	fail-on-alert: true
	comment-on-alert: true # notify on PR if alert triggers
	summary-always: true # always comment on PRs to leave job summary

Provide feedback