Merge pull request #16 from github/copilot/define-workflow-permissions

Add explicit permissions to GitHub Actions workflows

Author: jonrohan

.github/workflows/nodejs.yml

@@ -1,15 +1,19 @@
 name: Node CI
 
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: macos-latest
     steps:
     - uses: actions/checkout@v2
-    - name: Use Node.js 12.x
-      uses: actions/setup-node@v1
+    - name: Use Node.js 20.x
+      uses: actions/setup-node@v6
       with:
-        node-version: 12.x
+        node-version: 20.x
     - name: npm install, build, and test
       run: |
         npm install

.github/workflows/publish.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   publish-npm:
     runs-on: ubuntu-latest