From 884b922fd9accd7f490c90a85ff94d315105e715 Mon Sep 17 00:00:00 2001
From: lufia <lufia@lufia.org>
Date: Fri, 5 Jun 2026 00:40:20 +0900
Subject: [PATCH] .github/workflows: permissions

Change-Id: If925f2077c5ff890e2d8242b59b40b798d3b653e
---
 .github/workflows/test.yml | 2 ++
 .github/workflows/vuln.yml | 3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5402c66..5cbe09a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -5,6 +5,8 @@ on:
     branches:
     - main
   pull_request:
+permissions:
+  contents: read
 jobs:
   # FIXME(lufia): revert this
   #
diff --git a/.github/workflows/vuln.yml b/.github/workflows/vuln.yml
index 26969ef..604bf93 100644
--- a/.github/workflows/vuln.yml
+++ b/.github/workflows/vuln.yml
@@ -3,7 +3,8 @@ name: Vulncheck
 on:
   schedule:
   - cron: '0 10 */14 * *'
+permissions:
+  contents: read
 jobs:
   vuln:
-    permissions:
     uses: lufia/workflows/.github/workflows/go-vulncheck.yml@bfc84184198b340bf1c34b2c695c2810a8e0897e # v0.11.1