From b605be811702703f4f9d95b55f2cc723630b864b Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Wed, 13 May 2026 08:37:59 +0000 Subject: [PATCH] ci: declare contents: read on validate_pyinstaller workflow PR-triggered build of the PyInstaller bundle for linux/macos/windows. Each job is a build matrix that runs docker + python + pyinstaller. No push, no comment, no release write - contents: read suffices. Signed-off-by: Arpit Jain --- .github/workflows/validate_pyinstaller.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/validate_pyinstaller.yml b/.github/workflows/validate_pyinstaller.yml index 094e3b0b6db..9f4e9c5d389 100644 --- a/.github/workflows/validate_pyinstaller.yml +++ b/.github/workflows/validate_pyinstaller.yml @@ -8,6 +8,9 @@ on: env: CI_OVERRIDE: "1" +permissions: + contents: read + jobs: build-for-linux: name: build-pyinstaller-linux