Potential fixes for 3 code scanning alerts

[cinderellasecure]

Potential fixes for 3 code scanning alerts from the Copilot AutoFix: Missing Permissions in Workflows security campaign:

• https://github.com/github/catalyst/security/code-scanning/5
  To fix the problem, we should add a permissions: block specifying the minimal necessary permissions for the job. In this case, the workflow only interacts with npm (publishing to it), and reads from the repository (checking out code, reading package.json, etc.), so contents: read is sufficient. This block should be placed either at the root of the workflow or at the publish-npm job level. For clarity and ease, placing it at the workflow root is recommended, so all jobs inherit least privilege unless otherwise specified. No other changes or imports are necessary.

  ---

• https://github.com/github/catalyst/security/code-scanning/4
  To fix the problem, add a permissions block specifying the least privilege required at either the workflow or the job level. Since the whole workflow does not appear to perform any operations requiring write permissions (e.g. status updates, PR creation, etc.), setting permissions: contents: read at the workflow (top) level is recommended. This will apply to all jobs in the workflow, ensuring they cannot modify repository contents or metadata through GITHUB_TOKEN unless specifically required and overridden. Edit .github/workflows/nodejs.yml: insert the permissions: block after the name line and before on:.

  ---

• https://github.com/github/catalyst/security/code-scanning/3
  The problem is best fixed by adding an explicit permissions block with the least privilege required for the workflow at the top level of the workflow YAML (right after the name key, before on:). This will ensure all jobs inherit the desired permission restrictions unless overridden. Given the context (documentation build and Lighthouse CI), contents: read (the minimum) looks sufficient. If more permissions are needed in the future, they can be added as required.

  To implement the fix:

  • Edit .github/workflows/lighthouse.yml.
  • Insert a permissions: block with contents: read after the name: statement.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This pull request adds explicit permission declarations to GitHub Actions workflows, implementing the principle of least privilege by setting contents: read as the default permission. This is a security enhancement that restricts workflow permissions to read-only access to repository contents unless explicitly elevated.

Key Changes:

• Added permissions declarations to three workflow files
• Set contents: read as the base permission level for all workflows

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/publish.yml	Added read-only contents permission to the publish workflow
.github/workflows/nodejs.yml	Added read-only contents permission to the build workflow
.github/workflows/lighthouse.yml	Added read-only contents permission to the lighthouse workflow

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[TylerJDev]

Thanks for the PR @cinderellasecure!