From 5004e07d0a279ba869bb50065bdcbf0e13023f36 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 14 May 2026 11:58:23 +0900 Subject: [PATCH] ci: declare contents:read on CI Typescript workflow The Build Typescript job runs pnpm install + builds inside lang/typescript. No GitHub API write beyond actions/checkout. contents:read is the floor. Style matches the per-job permissions block in npm-release.yml (id-token:write + contents:write + pull-requests:write for the release path). Signed-off-by: Arpit Jain --- .github/workflows/ci-typescript.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci-typescript.yml b/.github/workflows/ci-typescript.yml index 1315487c..fc2936dd 100644 --- a/.github/workflows/ci-typescript.yml +++ b/.github/workflows/ci-typescript.yml @@ -6,6 +6,9 @@ on: branches: - main +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest