Update 8hobbies/workflows digest to 35aaff6

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	9ce095e -> 35aaff6

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

To fix the detected issue, you should add the permissions key to the workflow definition (.github/workflows/lint.yml) at the root level (above jobs), unless jobs require specific permissions. As the lint job appears to perform only linting, it is likely sufficient to set contents: read. Place the permissions: block immediately after the workflow name: and before on:, as recommended by GitHub best practices. No additional imports, definitions, or methods are needed; the only change is the YAML block addition.

---

To address this issue, you should add a permissions block to either the top level of .github/workflows/publish-dry-run.yml or to the specific job under jobs:. Since there is only a single job (run:), the recommended approach is to place the permissions key at the top level of the workflow file, just after the name: and before on:. This limits the permissions of GITHUB_TOKEN for the entire workflow unless overridden by a job. As a minimal starting point, use permissions: {} to fully restrict all default permissions. If your workflow requires specific permissions (for example, contents: read for fetching code), set only those that are necessary for the workflow to function. In this case, since the workflow delegates all functionality to a reusable workflow, it is safest to start with the most restrictive block {} and incrementally add needed permissions if jobs fail due to lack of access.

---

To fix this issue, we should explicitly add a permissions: block to the workflow file, .github/workflows/runtime.yml, either at the root (which then applies to all jobs) or for the specific job (in this case, the only job is test). Because this workflow only delegates to a reusable workflow (uses), and unless we know more about what specific permissions are required, we should set contents: read as the minimal safe default. If additional permissions (such as pull-requests: write) are required by the reusable workflow, those should also be listed, but starting with the minimal case is appropriate. The edit is to insert a permissions: block at the top level, immediately below name: Runtime.