fix: gh actions permissions

Author: patriksimek

.github/workflows/deploy-npm.yml

@@ -8,6 +8,8 @@ on:
 jobs:
     test:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
         timeout-minutes: 10
         strategy:
             matrix:
@@ -30,6 +32,8 @@ jobs:
 
     publish:
         needs: test
+        permissions:
+            contents: read
         runs-on: ubuntu-latest
         steps:
             - name: Checkout
@@ -42,15 +46,6 @@ jobs:
                   registry-url: 'https://registry.npmjs.org'
                   cache: 'npm'
 
-            - name: Install dependencies
-              run: npm ci
-
-            - name: Build version
-              run: npm run build:version
-
-            - name: Build
-              run: npm run build
-
             - name: Publish to npm
               run: npm publish --access public
               env:

.github/workflows/test.yml

@@ -10,6 +10,8 @@ on:
 jobs:
     test:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
         timeout-minutes: 10
         strategy:
             matrix: