Explicit permissions to GitHub workflow

[killev]

Added a permissions block to the code-quality.yml workflow that limits the workflow's access to only what it needs:

• Read access to repository contents
• Write access to security events for scan results

This follows the principle of least privilege and improves overall security.

[Copilot]

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

[github-actions]

🔍 Vulnerabilities of apostrophe-cms:test

📦 Image Reference apostrophe-cms:test

digest	sha256:9c4e364f8b5613ff438f37fab382b76447254b0ab026ecb03712f3fa812de522
vulnerabilities
platform	linux/amd64
size	235 MB
packages	1082

📦 Base Image node:23-alpine

also known as	23-alpine3.21 23.11-alpine 23.11-alpine3.21 23.11.0-alpine 23.11.0-alpine3.21 alpine alpine3.21 current-alpine current-alpine3.21
digest	sha256:0d468be7d2997dd2f6a3cda45e121a6b5140eb7ba3eba299a215030dbb0fb1ca
vulnerabilities

async 0.9.2 (npm) pkg:npm/[email protected] OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <2.6.4 Fixed version 2.6.4, 3.2.2 CVSS Score 7.8 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS Score 0.915% EPSS Percentile 74th percentile Description A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2), which could let a malicious user obtain privileges via the mapValues() method.

async 1.5.2 (npm) pkg:npm/[email protected] OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities Affected range <2.6.4 Fixed version 2.6.4, 3.2.2 CVSS Score 7.8 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H EPSS Score 0.915% EPSS Percentile 74th percentile Description A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2), which could let a malicious user obtain privileges via the mapValues() method.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud