From e89faeccaeb2daca20b3723e7e24c8c26b29af79 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 12 Feb 2026 03:09:06 +0000
Subject: [PATCH] ci: add workflow-level permissions for least privilege

Add top-level `permissions: contents: read` to the tests workflow,
addressing CodeQL alerts about missing GITHUB_TOKEN permissions.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 .github/workflows/tests.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 484c1645..192b6276 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -2,6 +2,9 @@ name: Run Tests & Linting
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   # ── Tests ──────────────────────────────────────────────────────────────
   test: