Setting permissions to CI workflows.

.github/workflows/release.yml

@@ -4,20 +4,21 @@ on:
   release:
     types:
       - published
-
+permissions:
+  contents: read
 jobs:
   release:
     if: ${{ github.repository_owner == 'cloudflare' }}
     name: Publishing to npmjs registry
     runs-on: ubuntu-latest
     steps:
       - name: Checking out
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - name: Use Node.js 20
-        uses: actions/setup-node@v4
+      - name: Use Node.js 22
+        uses: actions/setup-node@v5
         with:
           node-version: 22
           # registry-url is required to correctly setup authentication per https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry

.github/workflows/semgrep.yml

@@ -8,6 +8,8 @@ on:
   schedule:
     - cron: '0 0 * * *'
 name: Semgrep config
+permissions:
+  contents: read
 jobs:
   semgrep:
     name: semgrep/ci

.github/workflows/tests.yml

@@ -7,7 +7,8 @@ on:
   pull_request:
     branches:
       - main
-
+permissions:
+  contents: read
 jobs:
   testing:
     name: Testing on Node v${{ matrix.node }}
@@ -17,10 +18,10 @@ jobs:
         node: [22, 20]
     steps:
       - name: Checking out
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Use Node.js v${{ matrix.node }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: ${{ matrix.node }}
           cache: 'npm'