Problem
.github/workflows/dead-link-check.yml, pricing-review.yml, stale.yml, and welcome.yml all declare an explicit permissions: block scoped to what they need. lint.yml, markdownlint.yml, and test.yml don't declare one at all, so they silently inherit whatever the repo's default GITHUB_TOKEN permissions happen to be. That default is currently read-only at the repo level, but nothing in the workflow file itself guarantees that, and it's an easy setting to change by accident later.
What to do
Add permissions:\n contents: read to lint.yml, markdownlint.yml, and test.yml — the only access any of them needs (checkout + run a script).
Acceptance criteria
Scope: tiny, roughly 10 minutes. Good first issue.
Problem
.github/workflows/dead-link-check.yml,pricing-review.yml,stale.yml, andwelcome.ymlall declare an explicitpermissions:block scoped to what they need.lint.yml,markdownlint.yml, andtest.ymldon't declare one at all, so they silently inherit whatever the repo's defaultGITHUB_TOKENpermissions happen to be. That default is currently read-only at the repo level, but nothing in the workflow file itself guarantees that, and it's an easy setting to change by accident later.What to do
Add
permissions:\n contents: readtolint.yml,markdownlint.yml, andtest.yml— the only access any of them needs (checkout + run a script).Acceptance criteria
permissions: contents: readexplicitlymainScope: tiny, roughly 10 minutes. Good first issue.