From 572c0ff9e6c9fff4406cede7880035614b8a0a8f Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 14 May 2026 03:04:32 +0900 Subject: [PATCH] ci: declare contents: read on the CI workflow The 9 jobs in ci.yml (checks, windows-checks, tests, timings, deny, linux-integration, windows-integration, results) all run actions/checkout plus build/test steps. None push back to the repo or call write APIs, so contents: read is the right floor. cover.yml / labeler.yml / publish.yml / stale.yml in this repo already declare permissions (per-job). Signed-off-by: Arpit Jain --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9757ce71..4af8be89 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: schedule: - cron: '0 0 * * *' # Every day at midnight +permissions: + contents: read + jobs: checks: name: Checks