Potential fix for code scanning alert no. 4: Workflow does not contain permissions

[Simek]

Potential fix for https://github.com/react-native-community/directory/security/code-scanning/4

In general, fix this by explicitly declaring a permissions block that grants only the minimal required scopes for this workflow. Since this job only checks out code and deploys using external tokens, it needs only read access to repository contents.

The best fix without changing existing functionality is to add a root-level permissions block (applies to all jobs) near the top of .github/workflows/code-deploy-production.yml, e.g. after name: and before on:. Set contents: read, which corresponds to read-only access to the repository contents and matches CodeQL’s suggested minimal starting point. No other scopes (like pull-requests, issues, etc.) appear necessary given the current steps.

Concretely:

• Edit .github/workflows/code-deploy-production.yml.
• Insert:

  permissions:
    contents: read

  between line 1 (name: '[CODE] Deploy production website') and line 3 (on:).
  No imports or additional definitions are needed since this is a YAML workflow configuration change only.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.