Potential fix for code scanning alert no. 3: Workflow does not contain permissions

[teolemon]

Potential fix for https://github.com/openfoodfacts/nutripatrol-frontend/security/code-scanning/3

To address this issue, you should add an explicit permissions block to your workflow to limit the GITHUB_TOKEN's scope. Since none of the deploy steps require write access to repository contents, the principle of least privilege applies, and you should restrict permissions to contents: read, which means the workflow can only read repository contents, not write or alter them. This block can be added either at the workflow root (recommended when all jobs have the same minimal permissions), or to each individual job. In this case, adding it at the root near the top of the .github/workflows/deploy.yml file—prior to the jobs: block—is clear and effective.

Implementation steps:

• Insert the following block after the name: ... line, before the on::

  permissions:
    contents: read

• No new methods, imports, or definitions are needed for this YAML change.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.