From 5066d35e96f6c0cce1870db99a5c5a754ca87005 Mon Sep 17 00:00:00 2001
From: James Maes <james@kof22.com>
Date: Fri, 16 Oct 2026 16:10:51 -0500
Subject: [PATCH] ci: restrict workflow token to contents: read

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af9b0fd..7d93c84 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main, develop ]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
-- 
2.54.0