fix: code scanning alert no. 2: Workflow does not contain permissions

[John Kennedy (jkennedyvz)]

Potential fix for https://github.com/langchain-ai/new-langgraph-project/security/code-scanning/2

In general, the fix is to add an explicit permissions block either at the workflow level (applies to all jobs) or at the job level (for just unit-tests), restricting the GITHUB_TOKEN to the minimal rights needed. This workflow only requires read access to the repository contents (for actions/checkout) and possibly to packages/artifacts if the environment did so, but in the shown steps nothing is published back to GitHub, so contents: read is sufficient as a minimal starting point.

The best fix without changing existing functionality is to add a workflow‑level permissions section immediately after the on: trigger block, configuring contents: read. This will apply to the unit-tests job (and any future jobs that don’t override permissions) and will not interfere with any current steps, since none of them require write access. Concretely, in .github/workflows/unit-tests.yml, insert:

permissions:
  contents: read

between the on: block and the concurrency: block (around current lines 9–11). No imports or additional definitions are required, as this is standard GitHub Actions workflow syntax.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.