ci: set explicit workflow permissions to read (should be a no-op) (#5318)

* We're using restricted GITHUB_TOKENS by default. * This is expected to be a no-op operation for codeql.
2026-08-23 16:12:25 +02:00 · 2025-07-02 17:02:17 -04:00
parent 339de4c204
commit e28af0ffc3
11 changed files with 33 additions and 0 deletions
@@ -8,6 +8,9 @@ on:
        type: string
        description: "From which folder this pipeline executes"

+permissions:
+  contents: read
+
 jobs:
  build:
    runs-on: ubuntu-latest