From 05ac6a911c4b1e2604bc5841f4fd3745e263a383 Mon Sep 17 00:00:00 2001
From: oracola91 <118899664+oracola91@users.noreply.github.com>
Date: Fri, 23 Oct 2026 17:19:22 +0300
Subject: [PATCH] ci: read-only token for the CI workflow (#4026)

ci.yml had no permissions block, so its token got the repository
default. Its jobs only check out code, restore caches and upload
artifacts, so contents: read is enough.

The permissions half of item 6 in #1114.
---
 .github/workflows/ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a21cbdfd6..79ba4a2cf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: "17 3 * * *" # nightly fuzzing
 
+# The token is only used to check out the code: no job writes to the repository.
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: 1