Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[AlexGalichenko]

Potential fix for https://github.com/qavajs/steps-memory/security/code-scanning/1

To fix the referenced problem, add a permissions block explicitly either at the workflow root (to apply to all jobs), or at the job (publish-npm) level. Since this workflow only has a single job, either approach works; most maintainers put it at the root for future extensibility. As this workflow publishes to npm (which uses secrets for authentication rather than GITHUB_TOKEN), the only GitHub permission needed is for reading and possibly writing repository contents (esp. if tagging or making changes, but in this workflow, only publishing from existing contents). By least privilege, set permissions: contents: read at the root. However, if you know for sure that npm publish (with this setup) occasionally needs to update repotags, consider contents: write. The safest minimal change is to add:

permissions:
  contents: read

directly under the name: key, i.e., at the top of the file before the on block.

No new methods or imports are required for this fix—just add the correct configuration lines.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud