Release v0.8.4

[jtherrmann]

TODO:

• changelog #302

To fix the problem, add a permissions block at the root level of the workflow or within the specific job that calls the reusable workflow. Since the job only invokes a reusable workflow, and to follow the principle of least privilege, start with the minimal permissions block, such as contents: read. This limits the permissions granted to the GITHUB_TOKEN for this workflow and any jobs (unless individually overridden). Edit .github/workflows/changelog.yml and insert the permissions block immediately after the workflow's name and before on: so it applies to all jobs by default. No additional imports or definitions are required for this YAML file change.

To fix the problem, an explicit permissions: block should be added, either at the root of the workflow or within the job definition. For a workflow calling a reusable workflow, in nearly all cases contents: read is sufficient unless the reusable workflow requires more.

The single best fix is to add

permissions:
  contents: read

directly below the name: line at the top of .github/workflows/labeled-pr.yml. This applies the minimal permissions to all jobs in this workflow.

No imports, new methods, or further changes are needed.

---

The best way to fix this problem is to add a permissions block at the root of .github/workflows/static-analysis.yml, with the least privilege needed for static analysis jobs. Since typical static analysis workflows only require read access to repository contents (and no write access to issues, pull requests, etc.), you can use contents: read as a starting point. This block should be inserted immediately under the workflow name, before the on: key. If specific jobs later need additional permissions, such as writing PR comments or updating statuses, those jobs can define their own permissions. For now, set the most restrictive permissions globally.