From 6658732d338b38c80a5ddfee5f94827428314d77 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 20 Apr 2026 16:56:54 -0500
Subject: [PATCH] ci: drop default workflow token permissions

The test workflow only needs to evaluate and build repository code. It
does not write statuses, labels, comments, or pull request metadata, so
keeping GitHub's default token scope is broader than necessary.
---
 .github/workflows/test.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ee2883fc8..ccef07eeb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,7 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.run_id }}
   cancel-in-progress: true
+permissions: {}
 jobs:
   changes:
     runs-on: ubuntu-latest