From 49baae116af18fa4981aea34dd6338ac9f5e07be Mon Sep 17 00:00:00 2001
From: Guido Dinello <guido.dinello@gmail.com>
Date: Mon, 17 Aug 2026 20:38:25 -0300
Subject: [PATCH] security: least-privilege permissions for Code Quality
 workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

contents: read — format-check/lint/test don't write anything.
dependabot-automerge.yml was already correctly scoped.
---
 .github/workflows/pipeline.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/pipeline.yaml b/.github/workflows/pipeline.yaml
index 6542e78..c325b48 100644
--- a/.github/workflows/pipeline.yaml
+++ b/.github/workflows/pipeline.yaml
@@ -7,6 +7,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
     quality:
         runs-on: ubuntu-latest