setting permissions to remove security warning (#215)

.github/workflows/ci.yml

@@ -2,6 +2,14 @@ name: Grype CI
 on:
   workflow_dispatch:
   push:
+
+permissions:
+  # required for all workflows
+  security-events: write
+  # only required for workflows in private repositories
+  actions: read
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/publish.yml

@@ -2,6 +2,10 @@ name: Publish Package to npmjs
 on:
   release:
     types: [published]
+
+permissions:
+   contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/yarn-test.yml

@@ -7,6 +7,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build: