chore: Add permissions block to quality CI job

lukekim · lukekim · commit 55ea00e266e8 · 2026-03-25T15:11:41.000-07:00
Address CodeQL finding: restrict GITHUB_TOKEN to contents:read.
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -191,6 +191,8 @@ jobs:
     name: Code quality checks
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 
