ci: set contents permissions to read

flavorjones · flavorjones · commit 96e45c50cc44 · 2026-03-14T12:03:23.000-04:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -17,6 +17,9 @@ on:
     branches:
       - '*'
 
+permissions:
+  contents: read
+
 env:
   BUNDLE_WITHOUT: "development"
 
diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml
@@ -17,6 +17,9 @@ on:
     branches:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   activerecord:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/upstream.yml b/.github/workflows/upstream.yml
@@ -13,6 +13,9 @@ on:
     paths:
       - .github/workflows/upstream.yml # this file
 
+permissions:
+  contents: read
+
 jobs:
   sqlite-head:
     runs-on: ubuntu-latest
