Potential fixes for 2 code scanning alerts

[cinderellasecure]

Potential fixes for 2 code scanning alerts

• https://github.com/github/text-expander-element/security/code-scanning/4
  To address the problem, add an explicit permissions: key to restrict the GITHUB_TOKEN in the workflow. This is most effective when added at the workflow root, applying it to all jobs unless individually overridden. The minimal recommended setting is contents: read, which is sufficient unless the workflow (or specific job steps) truly requires additional permissions. In the provided workflow, publishing to npm uses NODE_AUTH_TOKEN from secrets and does not require GITHUB_TOKEN write access, so contents: read is the safest starting point. The edit should occur at the root of the workflow, for instance between the name: and on: keys. No additional imports or external dependencies are needed.

• https://github.com/github/text-expander-element/security/code-scanning/3
  To fix the issue, add a permissions block specifying the minimal required privileges for the job. Since the workflow installs dependencies, runs a build, and tests, but does not write to the repository or perform operations requiring more privileges, contents: read is sufficient. Place the block at the job-level (build: job) since the job is flagged, or alternatively at the workflow root to cover all jobs. In this case, adding it under the build: job is clear and direct.

  Edit .github/workflows/nodejs.yml and insert:

  permissions:
  contents: read

  immediately after the job name (build:), before runs-on:.

  No additional methods, imports, or dependencies are needed.

  ---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR adds explicit permission declarations to GitHub Actions workflows to follow the principle of least privilege. The changes restrict workflow permissions to read-only access to repository contents.

• Added top-level permissions block to the publish workflow
• Added job-level permissions block to the build job in the nodejs workflow

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/publish.yml	Added top-level permissions setting with read-only contents access
.github/workflows/nodejs.yml	Added job-level permissions setting with read-only contents access for the build job

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.