Fix/sonarcloud alerts

.github/workflows/ci.yml

@@ -8,17 +8,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-  pull-requests: write
-  checks: write
+permissions: {}
 
 jobs:
   setup:
     name: Setup
     runs-on: ubuntu-latest
     timeout-minutes: 10
     if: github.event.pull_request.draft == false
+    permissions:
+      contents: read
 
     outputs:
       node-version: ${{ steps.volta.outputs.node-version }}
@@ -38,6 +37,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: [setup]
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
@@ -60,6 +61,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: [setup]
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
@@ -82,6 +85,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: [setup]
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
@@ -111,6 +116,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     needs: [setup]
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
 
     steps:
       - name: Checkout code