From efea151d03d742bc97cfb59595ff079c91ea7090 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 14 May 2026 03:03:46 +0900 Subject: [PATCH] ci: declare contents: read on the CI workflow The three CI jobs (checks, linters, tests) only check out the repo and run build/test. codeql.yml in this repo already declares per-job permissions (actions: read + contents: read); ci.yml gets a workflow-level cap. Signed-off-by: Arpit Jain --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 552519c5..26220eaf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [ main ] +permissions: + contents: read + jobs: checks: