ci: use explicit and per job permissions (#3002)

* ci: use explicit and per job permissions * update CHANGELOG
2026-07-28 14:47:08 -07:00 · 2026-04-07 14:39:41 -06:00
parent c55b06860c
commit 0798528b7b
9 changed files with 20 additions and 12 deletions
@@ -9,11 +9,10 @@ on:
      - '**.md'
  workflow_dispatch: # allow manual trigger

-permissions:
-  contents: write
-
 jobs:
  ruff-format:
+    permissions:
+      contents: write
    # only run on dependabot PRs or manual trigger
    if: github.actor == 'dependabot[bot]' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-22.04