ci: set least-privilege GITHUB_TOKEN permissions in workflow

[jhamon]

Theme: Security

Problem

.github/workflows/ci.yml declares no permissions: block, so GITHUB_TOKEN is granted the repository/organization default scopes for both jobs (build-and-test and audit). GitHub code scanning flags this as two open alerts:

• Alert chunk size hard coded to 100 #1 — actions/missing-workflow-permissions at ci.yml:16 (build-and-test)
• Alert Updates for v1 node client #2 — actions/missing-workflow-permissions at ci.yml:50 (audit)

Neither job needs write access — they only checkout, install, lint, typecheck, test, and run npm audit.

Proposed fix

Add an explicit top-level least-privilege block:

permissions:
  contents: read

Widen per-job only if a future job needs more. Confirm CodeQL re-scans clean after merge.

Acceptance criteria

• ci.yml sets least-privilege permissions (top level contents: read).
• Both code-scanning alerts move to fixed/closed after the workflow runs on the merge commit.
• CI stays green.

Blast radius

safe

Dependencies

None.