fix: add explicit empty permissions to docs-broken-links workflow (#1131)

* fix: add explicit empty permissions to docs-broken-links workflow

This addresses CodeQL alert #1 (actions/missing-workflow-permissions).
The workflow checks for broken links in docs using Mintlify CLI and
doesn't require any GitHub token access. Adding permissions: {} ensures
the workflow runs with minimal privileges, reducing supply-chain risk.

Co-authored-by: Michael Sukkarieh <msukkari@users.noreply.github.com>

* chore: add CHANGELOG entry for workflow permissions fix

Co-authored-by: Michael Sukkarieh <msukkari@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Michael Sukkarieh <msukkari@users.noreply.github.com>

Author: msukkari

.github/workflows/docs-broken-links.yml

@@ -1,5 +1,7 @@
 name: Check for broken links in docs
 
+permissions: {}
+
 on:
   pull_request:
     branches: ["main"]

CHANGELOG.md

@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 - Fixed revision selection so the 64-revision cap prefers the newest matching branches and tags instead of pruning by ref-name order. [#1122](https://github.com/sourcebot-dev/sourcebot/pull/1122)
 - Fixed infinite pagination loop in Gitea/Forgejo when an API token can only see a subset of org repos (the `x-total-count` header reports org total while token returns fewer items). [#1130](https://github.com/sourcebot-dev/sourcebot/pull/1130)
+- Fixed missing workflow permissions in `docs-broken-links.yml` by adding explicit `permissions: {}` to follow least privilege principle. [#1131](https://github.com/sourcebot-dev/sourcebot/pull/1131)
 - Fixed CodeQL missing-workflow-permissions alert by adding explicit empty permissions to `deploy-railway.yml`. [#1132](https://github.com/sourcebot-dev/sourcebot/pull/1132)
 
 ## [4.16.11] - 2026-04-17