Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[JosueBrenes]

Potential fix for https://github.com/ACTA-Team/acta-credentials/security/code-scanning/1

Add an explicit permissions block for the build job in .github/workflows/npm-publish.yml, scoped to the minimum needed privilege. For this job, contents: read is sufficient (needed for actions/checkout), and no write scopes are required. Keep the existing publish-npm permissions unchanged, since it already explicitly requests contents: read and id-token: write for provenance publishing.

Best single change without altering functionality:

• In .github/workflows/npm-publish.yml, under jobs.build, insert:
  • permissions:
  • contents: read
• Place it alongside other job keys (runs-on, steps) so it applies only to build.

No imports, methods, or dependencies are needed (YAML workflow change only).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Summary by CodeRabbit

• Chores
  • Updated the package publishing workflow with explicit read-only repository access permissions.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: abd706ed-14bc-4ab8-8961-27ef5d59117b

📥 Commits

Reviewing files that changed from the base of the PR and between 19f119f and 17c404b.

📒 Files selected for processing (1)

• .github/workflows/npm-publish.yml

---

📝 Walkthrough

Walkthrough

The npm publish workflow now grants the build job explicit read-only access to repository contents.

Changes

npm publish permissions

Layer / File(s)	Summary
Build job contents permission .github/workflows/npm-publish.yml	The build job now declares contents: read permissions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch alert-autofix-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}