Potential fixes for 3 code scanning alerts

[cinderellasecure]

Potential fixes for 3 code scanning alerts from the Copilot AutoFix: Missing Permissions in Workflows security campaign:

• https://github.com/github/catalyst/security/code-scanning/5 To fix the problem, we should add a permissions: block specifying the minimal necessary permissions for the job. In this case, the workflow only interacts with npm (publishing to it), and reads from the repository (checking out code, reading package.json, etc.), so contents: read is sufficient. This block should be placed either at the root of the workflow or at the publish-npm job level. For clarity and ease, placing it at the workflow root is recommended, so all jobs inherit least privilege unless otherwise specified. No other changes or imports are necessary.

  ---

• https://github.com/github/catalyst/security/code-scanning/4 To fix the problem, add a permissions block specifying the least privilege required at either the workflow or the job level. Since the whole workflow does not appear to perform any operations requiring write permissions (e.g. status updates, PR creation, etc.), setting permissions: contents: read at the workflow (top) level is recommended. This will apply to all jobs in the workflow, ensuring they cannot modify repository contents or metadata through GITHUB_TOKEN unless specifically required and overridden. Edit .github/workflows/nodejs.yml: insert the permissions: block after the name line and before on:.

  ---

• https://github.com/github/catalyst/security/code-scanning/3 The problem is best fixed by adding an explicit permissions block with the least privilege required for the workflow at the top level of the workflow YAML (right after the name key, before on:). This will ensure all jobs inherit the desired permission restrictions unless overridden. Given the context (documentation build and Lighthouse CI), contents: read (the minimum) looks sufficient. If more permissions are needed in the future, they can be added as required.

  To implement the fix:

  • Edit .github/workflows/lighthouse.yml.
  • Insert a permissions: block with contents: read after the name: statement.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.