try and make the alerts happy

Author: masl2

.github/workflows/stage-1-commit.yaml

@@ -1,5 +1,8 @@
 name: "Commit stage"
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     inputs:
@@ -32,10 +35,6 @@ on:
         required: true
         type: string
 
-
-permissions:
-  contents: read
-
 jobs:
   scan-secrets:
     name: "Scan secrets"