Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[Johan Broberg (pontemonti)]

Potential fix for https://github.com/microsoft/Agent365-nodejs/security/code-scanning/2

To fix this issue, you should add an explicit permissions block with the minimal required privileges to the affected job (nodejs-sdk). Since the steps performed are read-only (building, testing, artifact upload) and do not modify repository contents or interact with issues/pull-requests, the contents: read permission is sufficient and safest. Edit the .github/workflows/ci.yml file, adding the following under the nodejs-sdk job definition (right after line 46, under runs-on: ubuntu-latest). No imports or further code changes are required—just this YAML configuration block.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a code scanning security alert by adding an explicit permissions block to the nodejs-sdk job in the CI workflow. The change follows the principle of least privilege by restricting the job to read-only access to repository contents.

• Adds permissions: contents: read to the nodejs-sdk job
• Ensures the job has minimal required privileges for its read-only operations (build, test, artifact upload)

Comments suppressed due to low confidence (1)

.github/workflows/ci.yml:12

• The changed-sdks job is also missing an explicit permissions block. Since this job only performs read-only operations (checkout and git diff), it should also have permissions: contents: read added for consistency and to address the same security concern. Add the permissions block after line 12, similar to the fix applied to the nodejs-sdk job.

  changed-sdks:
    name: Determine Changed SDKs
    runs-on: ubuntu-latest