From c79ee85529789f14b102f9740d95dcabc7a78bd1 Mon Sep 17 00:00:00 2001
From: Mathieu Rabine <rabine.mathieu@gmail.com>
Date: Sun, 15 Mar 2026 10:10:08 +0100
Subject: [PATCH] Update build.yml with permissions and cache-to changes

Add permissions for contents read and update cache-to syntax.
---
 .github/workflows/build.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1522daf..f8c69be 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -17,6 +17,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+
     defaults:
       run:
         shell: bash
@@ -56,4 +59,4 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=registry,ref=${{ secrets.DOCKERHUB_USER }}/join-ci:buildcache
-          cache-to: type=registry,ref=${{ secrets.DOCKERHUB_USER }}/join-ci:buildcache,mode=max
+          cache-to: ${{ inputs.deploy && format('type=registry,ref={0}/join-ci:buildcache,mode=max', secrets.DOCKERHUB_USER) || '' }}