From d1afb68da9321481324f9c19362a6acd300c7aac Mon Sep 17 00:00:00 2001 From: Matt McKay Date: Wed, 5 Aug 2026 13:24:12 +1000 Subject: [PATCH] Add a permissions block to linkcheck.yml, matching the other workflows Completes the hardening #54 landed for ci, collab and publish: the dawidd6 cache download works today via public-repo API leniency, but granting actions: read explicitly matches the documented requirement and the blocks the other workflows now carry. Raised by Copilot on the superseded #53. Co-Authored-By: Claude Fable 5 --- .github/workflows/linkcheck.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/linkcheck.yml b/.github/workflows/linkcheck.yml index f8ac2d5..a416a0c 100644 --- a/.github/workflows/linkcheck.yml +++ b/.github/workflows/linkcheck.yml @@ -9,6 +9,9 @@ jobs: link-check-linux: name: Link Checking (${{ matrix.python-version }}, ${{ matrix.os }}) runs-on: ${{ matrix.os }} + permissions: + contents: read + actions: read # dawidd6/action-download-artifact reads the cache.yml build artifact strategy: fail-fast: false matrix: