ci: set explicit workflow permissions to read (should be a no-op) (#5318)

* We're using restricted GITHUB_TOKENS by default. * This is expected to be a no-op operation for codeql.
2026-08-23 08:02:23 +02:00 · 2025-07-02 17:02:17 -04:00
parent 339de4c204
commit e28af0ffc3
11 changed files with 33 additions and 0 deletions
@@ -5,6 +5,9 @@ on:
    paths:
      - "libs/**"

+permissions:
+  contents: read
+
 jobs:
  benchmark:
    runs-on: ubuntu-latest