Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[Tanker187]

Potential fix for https://github.com/Tanker187/firebase-admin-node/security/code-scanning/1

In general, the fix is to add an explicit permissions: block that grants only the scopes actually needed by this job. Since the job just checks out the code and runs local Node.js builds and tests, the minimal permission contents: read at the workflow or job level is appropriate. This documents the intended privilege and ensures the token stays limited even if repository defaults change or the workflow is copied elsewhere.

The single best way to fix this, without changing existing functionality, is to add a job-level permissions: block under build: (the job CodeQL flagged). This keeps the scope of the change tight and clearly associates the permissions with this specific job. Concretely, in .github/workflows/ci.yml, insert:

    permissions:
      contents: read

indented to align with runs-on: and strategy: within the build job, between build: and runs-on: (or just above runs-on:). No additional imports or definitions are needed, as this is purely a YAML configuration change for GitHub Actions.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.