Harden Github Action configuration (#3)

* Potential fix for code scanning alert no. 2: Workflow does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* fix permissions, add --provenance with perms, based our node images from .nvmrc

---------

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: sp3nx0r

.github/workflows/cd.yml

@@ -4,6 +4,10 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   build-test-publish:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -3,8 +3,9 @@ name: CI
 on:
   pull_request:
     branches: [main]
-  push:
-    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   build-and-test:
@@ -15,7 +16,7 @@ jobs:
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
 
       - name: Clean install
         run: |

package.json

@@ -4,7 +4,7 @@
   "description": "MCP for Devvit things",
   "license": "BSD-3-Clause",
   "author": "Marcus Wood",
-  "bugs": "https://github.com/modelcontextprotocol/servers/issues",
+  "bugs": "https://github.com/reddit/devvit-mcp/issues",
   "type": "module",
   "bin": {
     "devvit-mcp": "dist/index.js"