Potential fix for code scanning alert no. 1813: Workflow does not contain permissions

[ajay-dhangar]

Potential fix for https://github.com/codeharborhub/codeharborhub.github.io/security/code-scanning/1813

To fix the problem, explicitly restrict the GITHUB_TOKEN permissions for the build job so it does not inherit potentially broad repository defaults. The build job only checks out code, sets up Node, installs dependencies, builds, and uploads a Pages artifact; this only requires read access to repository contents and permission to write Pages artifacts. It does not need to write to the repository, issues, or pull requests.

The best fix is to add a permissions block to the build job that grants only contents: read and (optionally) id-token: none / other scopes omitted, and rely on the action’s own requirements. Since we must keep changes minimal and not alter existing behavior, we’ll set contents: read and add the minimal additional scope needed by actions/upload-pages-artifact—which, per GitHub documentation, uses the Pages deployment pipeline and does not require general repo write access. A simple and safe configuration is:

permissions:
  contents: read

inserted under the build job, at the same indentation as runs-on. The deploy job already has a suitable permissions block and doesn’t need modification. No additional imports or dependencies are required, and no steps change; we are only tightening the token permissions.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Great job, @ajay-dhangar! 🎉 Thank you for submitting your pull request to CodeHarborHub. We appreciate your contribution and enthusiasm! Our team will review it soon. If you have any questions or need further assistance, feel free to reach out. Thanks for contributing!

[deepsource-io]

DeepSource Code Review

We reviewed changes in b1a4315...eabdc42 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Sep 23, 2026 3:47a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[github-actions]

⚡️ Lighthouse Report for the Deploy Preview of this PR 🚀

🔗 Site: CodeHarborHub | Live Site

URL 🌐	Performance	Accessibility	Best Practices	SEO	📊
/	🔴 32	🟡 88	🟡 75	🟢 100	📄
/docs	🔴 41	🟡 87	🟡 75	🟢 100	📄
/courses	🟡 52	🟢 91	🟡 75	🟢 100	📄
/showcase	🔴 45	🟡 87	🟡 75	🟡 86	📄
/community	🔴 45	🟡 86	🟡 75	🟢 100	📄

[github-actions]

This PR has been automatically closed due to inactivity from the owner for 15 days.