From 31ff4de40b9ba54a0d2536d3640a23fd1c08b439 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 14 May 2026 12:00:18 +0900 Subject: [PATCH] ci: declare contents:read on Build workflow The Build workflow's single job installs pnpm dependencies and runs the build + library build. No GitHub API write, no cache directive, no comment on PRs. contents:read is the floor. Style matches the per-job permissions block in publish.yml (contents:read + id-token:write for trusted publishing). Signed-off-by: Arpit Jain --- .github/workflows/build.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 68a1713..44de805 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -6,6 +6,9 @@ on: - main pull_request: +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest