Update 8hobbies/workflows digest to 23566a1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	44f8438 -> 23566a1

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

To fix the issue, add a permissions block at the root level of .github/workflows/lint.yml. Place it before the jobs: key, after the name: or on: section. Set the permission(s) required for linting to the least privileged. In almost all cases for linting jobs, only contents: read should be needed, unless the lint process comments on PRs (then you might need pull-requests: write). Since we cannot see any evidence in this snippet that write permissions are needed, the best and safest default is contents: read, which restricts the GITHUB_TOKEN to only read repository contents.

To fix this problem, add an explicit permissions block to .github/workflows/publish-dry-run.yml. This block should specify the minimum required permissions for GITHUB_TOKEN. Since the workflow only uses a reusable workflow for running an npm publish dry run, in most cases read-only access to repository contents is sufficient. The block can be added at the top level (after the name: and before jobs:) to apply to all jobs, unless individual jobs require different permissions. In this case, add:

permissions:
  contents: read

just beneath the name: ... line and before on:. This grants only read access to repository contents, which is a safe default. If the workflow requires additional permissions (e.g., for pull-requests), those can be added, but based on the current code, contents: read suffices.

To fix the problem, add a permissions block to the workflow to restrict the GITHUB_TOKEN permissions to the minimal necessary. Since the workflow calls a reusable workflow, and we do not know exactly which permissions are required by npm-runtime.yml, the safest starting point is to specify permissions: {} at the root level. This sets all permissions to none unless the called workflow or jobs override it. If you know which exact permissions are needed (such as contents: read), you can specify those, but adding {} ensures no unnecessary permissions are granted by default.

Edits:

• In .github/workflows/runtime.yml, add the following block after the name: Runtime (line 15), or you may add it between the name and on (line 17).
• The block should be:

  permissions: {}

• No other changes, imports, or dependencies are needed.

---