Restrict default token permissions in create-release workflow

[Copilot]

This change addresses the code scanning finding on create-release.yml by explicitly denying unused GITHUB_TOKEN permissions in the release tagging path. The affected job already authenticates with secrets.PYPCAPKIT, so the workflow now documents and enforces that narrower permission model.

• Workflow permissions

  • Add an explicit empty permissions block to the tag job in .github/workflows/create-release.yml
  • Prevent the job from inheriting repository/org default GITHUB_TOKEN scopes

• Release tagging path

  • Preserve the existing authentication flow based on secrets.PYPCAPKIT
  • Leave release creation and package publishing behavior unchanged

tag:
  name: Conda Tag
  runs-on: ubuntu-latest
  permissions: {}

[JarryShaw]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved in d24cf2c.

[Copilot]

🟡 Changes recommended

The PR description claims the change is limited to workflow token permissions, but the PR also includes a public-facing model rename/alias update across code/tests/docs that should be reflected in the PR scope/description (or split).

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR narrows the create-release GitHub Actions workflow’s default GITHUB_TOKEN permissions for the release tagging path, and also standardizes the TCP reassembly hole data model name from HoleDiscriptor to HoleDescriptor while preserving a backwards-compatible alias.

Changes:

• Set permissions: {} on the tag job in .github/workflows/create-release.yml to avoid inheriting default GITHUB_TOKEN scopes (the job uses secrets.PYPCAPKIT for checkout/push).
• Rename the TCP reassembly hole model to HoleDescriptor and keep HoleDiscriptor as an alias for compatibility.
• Update tests and Sphinx docs to reference HoleDescriptor and validate aliasing.

File summaries

File	Description
.github/workflows/create-release.yml	Removes inherited GITHUB_TOKEN permissions for the tag job via an explicit empty permissions block.
pcapkit/foundation/reassembly/data/tcp.py	Renames hole model class to HoleDescriptor and aliases HoleDiscriptor to maintain compatibility; updates type hints/exports.
pcapkit/foundation/reassembly/tcp.py	Updates TCP reassembly implementation to use HoleDescriptor.
pcapkit/foundation/reassembly/data/__init__.py	Exposes TCP_HoleDescriptor alongside the existing TCP_HoleDiscriptor alias.
tests/foundation/reassembly/test_tcp.py	Updates TCP reassembly tests to use HoleDescriptor.
tests/foundation/reassembly/data/test_models.py	Updates model alias tests to cover HoleDescriptor and verify the alias relationship.
docs/source/pcapkit/foundation/reassembly/tcp.rst	Updates docs to reference HoleDescriptor in autodoc output.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[JarryShaw]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

[Copilot]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply ...

Addressed in 1dd16c7.