From ca9ed2b434f0a91e95cbc3949d11037345678589 Mon Sep 17 00:00:00 2001
From: Ogulcan Celik <ogulcancelik@gmail.com>
Date: Tue, 19 May 2026 04:39:47 +0300
Subject: ci: harden workflow permissions

---
 .github/workflows/ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

(limited to '.github/workflows/ci.yml')

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d85dd9c..8427d384 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
     paths-ignore:
       - "website/**"
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
@@ -23,6 +26,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install just
         uses: extractions/setup-just@v3
-- 
cgit v1.2.3