ci: tighten lint workflow permissions and step order

Agent-Logs-Url: https://github.com/sxjeru/CLIProxyAPI-Monitor/sessions/4dead3e2-6fd2-48ee-ac31-a7acb400c2ad

Co-authored-by: sxjeru <20513115+sxjeru@users.noreply.github.com>

Author: Copilot

.github/workflows/lint.yml

@@ -7,22 +7,25 @@ on:
       - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        run: corepack enable
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: pnpm
 
-      - name: Setup pnpm
-        run: corepack enable
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - 新增 GitHub Actions `lint` 工作流（`.github/workflows/lint.yml`）：
   - 在 `push`（`main/master`）与 `pull_request` 触发，统一执行 `pnpm install --frozen-lockfile` 与 `pnpm lint`。
+  - 工作流增加 `permissions: contents: read` 最小权限配置，降低默认令牌权限暴露面。
   - 通过 CI 自动校验代码风格，减少未被本地发现的 lint 问题进入主分支。
 
 ## 2026-04-15