1. Explicitly specify `contents: read` permissions in `checks.yml`
contents: readpermissions inchecks.yml