ci: add job-level GITHUB_TOKEN permissions on heavy workflow

mjameswh · mjameswh · commit 5d6825cf0cec · 2026-04-17T20:16:17.000-04:00
Align with Semgrep missing-explicit-permissions (job-scoped) expectations.
diff --git a/.github/workflows/heavy.yml b/.github/workflows/heavy.yml
@@ -15,6 +15,8 @@ concurrency:
 
 jobs:
   build-and-test:
+    permissions:
+      contents: read
     timeout-minutes: 20
     runs-on: ubuntu-latest-16-cores
     steps:
