From 7c17e079d387e0ccd7d199ddb6dfdf2dd587e579 Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Fri, 5 Dec 2025 15:33:27 -0500
Subject: [PATCH] ci: explicitly set permissions

Signed-off-by: Jason Hall <jason@chainguard.dev>
---
 .github/workflows/test.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index c0b7036..88ad6ef 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -23,6 +23,9 @@ jobs:
           - windows-latest
     runs-on: ${{ matrix.os }}
 
+    permissions:
+      contents: read
+
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2