Request approval to fix SonarCloud workflow permission warnings

[Varadraj75]

Hi @derberg @fmvilas @magicmatatjahu ,

I noticed that the SonarCloud quality gate for this repository is currently
failing due to new security warnings related to GitHub Actions workflow
permissions.

SonarCloud reports the following issue on new code:

• “Move this write permission from workflow level to job level”

These warnings appear in non-centrally-managed workflow files
(e.g. if-nodejs-release.yml) and are marked as new issues affecting the
security rating.

I would like to work on fixing these warnings by:

• Moving write permissions from the workflow level to only the jobs
  that actually require them
• Making no functional or behavioral changes to the workflows

Before proceeding, I wanted to ask for confirmation that this change is
acceptable and aligns with the project’s contribution process.

Happy to submit a PR once approved.
Thanks!

[github-actions]

Welcome to AsyncAPI. Thanks a lot for reporting your first issue. Please check out our contributors guide and the instructions about a basic recommended setup useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.

[derberg]

please point to exact security warnings you mentioned

[Varadraj75]

Thanks for checking @derberg ,

The SonarCloud security warnings are in:
.github/workflows/if-nodejs-release.yml

SonarCloud reports the issue
“Move this write permission from workflow level to job level”
for workflow-level permissions at:

• L21
• L22
• L23
• L24

All four are marked as new Security issues on the main branch.
I plan to move these write permissions to only the specific jobs that require them,
without changing any workflow behavior.

[derberg]

please point to exact security warnings you mentioned

link to sonar report please

[Varadraj75]

Sure, here is the SonarCloud report link pointing to the exact security warnings:
link

This shows the 4 “Move this write permission from workflow level to job level”
security issues at lines L21–L24 in .github/workflows/if-nodejs-release.yml
on the main branch.