Semgrep found 1 missing-explicit-permissions finding:

• .github/workflows/update-submodule.yml
  • L14-47 - Triage

No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).