Potential fix for code scanning alert no. 22: Workflow does not contain permissions

.github/workflows/Docker-exist.yml

@@ -0,0 +1,20 @@
+name: Docker image exists
+  # You may pin to the exact commit or the version.
+  # uses: cloudposse/github-action-docker-image-exists@4bdf41f05434b8b3570d45f34f9d43bc37b5f6a5
+  uses: cloudposse/github-action-docker-image-exists@0.2.0
+  with:
+    # Organization
+    organization: 
+    # Repository
+    repository: 
+    # Docker registry
+    registry: 
+    # Image name (excluding registry). Defaults to {{$organization/$repository}}.
+    image_name: # optional, default is 
+    # Tag
+    tag: 
+    # Docker login
+    login: # optional, default is 
+    # Docker password
+    password: # optional, default is 
+

.github/workflows/api-tests.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main, develop ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/docs-api.yml

@@ -1,7 +1,7 @@
 name: API Docs + SDKs
 
 on:
-  push:
+  trigger:
     branches: [main]
     paths:
       - "openapi/**"
@@ -34,7 +34,7 @@ jobs:
         run: |
           redocly build-docs openapi/openapi.yaml \
             --output public/docs/index.html \
-            --title "MBTQ API Documentation"
+            --title "deaf-first API Documentation"
 
       # --- SWAGGER UI ---
       - name: Build Swagger UI

.github/workflows/server.yml

@@ -0,0 +1,54 @@
+# This is a basic workflow to help you get started with Actions
+
+name: Server
+
+# Controls when the action will run. Triggers the workflow on push or pull request
+# events but only for the master branch
+on:
+  push:
+    branches: [main, master]
+    paths:
+      - 'functions/**'
+      - '.github/workflows/server.yml'
+
+defaults:
+  run:
+    working-directory: functions
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    concurrency:
+      group: ${{ github.ref }}-server
+      cancel-in-progress: true
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v4
+
+      - name: Setup Bun Runtime
+        uses: antongolub/action-setup-bun@v1
+
+      - name: Install Dependencies
+        run: bun install
+
+      - name: Lint code
+        run: bun run lint
+
+      #      - name: Test code
+      #        working-directory: functions
+      #        run: npm run test:ci
+
+      - name: Create .env file
+        run: |
+          echo "OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}" > .env
+          echo "UNKEY_ROOT_KEY=${{ secrets.UNKEY_ROOT_KEY }}" >> .env
+
+      - name: Deploy Cloud Functions
+        run: bun x firebase deploy --only functions:translate --token "${{ secrets.FIREBASE_TOKEN }}"

.github/workflows/update-npm-version.yml

@@ -0,0 +1,21 @@
+# .github/workflows/update-node-versions.yml
+name: update-node-versions
+
+on:
+  schedule:
+    - cron: "30 7 * * 0"
+
+jobs:
+  update-node-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: hongaar/update-node-versions@v2
+      - uses: peter-evans/create-pull-request@v5
+        with:
+          title: "feat: update node.js versions"
+          body: |
+            Automated changes by [update-node-versions](https://github.com/hongaar/update-node-versions) GitHub action
+
+            BREAKING CHANGE: This updates the supported node.js versions
+          token: ${{ secrets.GH_PAT }}