Potential fixes for 2 code scanning alerts

[cinderellasecure]

• https://github.com/github/prettier-config/security/code-scanning/2
  To fix the issue, add a permissions block with explicit least privilege to the publish-npm job. As the job only needs to publish to npm (using a personal access token from secrets.npm_token) and does not perform any package write operations requiring GITHUB_TOKEN, the minimum necessary permission is likely contents: read. This block should be inserted directly under the job name (immediately after publish-npm: and before runs-on:) in the publish-npm job. No other code changes or imports are required.

  ---

• https://github.com/github/prettier-config/security/code-scanning/1
  To fix the problem, you should add the permissions block to the workflow. Since this workflow does not contain any steps which create or modify repository content, issues, or pull requests, the minimal permission required is contents: read. You should add the following block immediately below the name: declaration at the top of the .github/workflows/test.yml file, which will set this as the default permission for all jobs in the workflow. No changes to existing functionality will occur. No new imports or definitions are required.

  ---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR adds read-only content permissions to GitHub Actions workflows to follow the principle of least privilege for security hardening.

• Adds workflow-level permissions to the test workflow
• Adds job-level permissions to the publish workflow's npm publishing job

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/test.yml	Adds workflow-level contents: read permission
.github/workflows/publish.yml	Adds job-level contents: read permission to the publish-npm job

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The publish-npm job likely requires contents: write permission to publish packages or create releases, not just contents: read. Additionally, it may need id-token: write for npm provenance if using trusted publishing. Verify the required permissions match the job's actual operations.

Suggested change

	contents: read
	contents: write

[jibrang]

I'm curious if we should follow copilot recommendation here to use contents write instead of read.

[cinderellasecure]

@jibrang I will suggest using the copilot recommendation. Thanks

[cinderellasecure]

Copilot recommendation is preferred.