Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[ch-zacmo]

Potential fix for https://github.com/A3KSA/swisscomSendJS/security/code-scanning/3

In general, the fix is to add an explicit permissions block that grants only the minimal scopes required by this workflow. Because this workflow just checks out code, installs dependencies, runs tests, and publishes to npm (using NODE_AUTH_TOKEN), it doesn’t need write access to repository contents or other scopes. A safe and recommended baseline is permissions: contents: read at the workflow or job level.

The simplest and most consistent fix without altering functionality is to add a top‑level permissions block right after the name: and before on: so it applies to both jobs, with contents: read. This documents the intent and ensures the GITHUB_TOKEN cannot be used to push commits, create releases, etc. No additional imports or external libraries are needed; this is a pure YAML configuration change within .github/workflows/npm-publish.yml.

Specifically, in .github/workflows/npm-publish.yml, insert:

permissions:
  contents: read

between lines 5 and 6 (after name: Node.js Package and before on:). No other lines need to change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.