VLN-474: Set explicit permissions for GitHub Actions workflows (#869)

picatz · web-flow · commit d510fd8f63ef · 2026-01-29T10:25:20.000-08:00
## Summary

- `.github/workflows/ci.yaml`: Set workflow-level permissions so the
GITHUB_TOKEN only reads repository contents and retains actions write
access needed for artifact uploads.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   build-test:
     strategy:
