Update 8hobbies/workflows digest to 6ffa892

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	23566a1 -> 6ffa892

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

To fix this problem and adhere to the principle of least privilege, add a permissions block to the root of the workflow file .github/workflows/lint.yml. This block should specify the minimum permissions required by the workflow. Since this is a linting workflow and most static analysis tools only require read access to the repository contents, set contents: read. If the workflow requires other permissions (for example, to update status checks or comment on pull requests), they can be added, but starting with contents: read is safe and minimal. Place the permissions block after the name field and before the on: trigger for clarity.

---

The recommended fix is to set an explicit permissions block to the workflow in .github/workflows/publish-dry-run.yml. The block can be set at the root level (applies to all jobs unless a job explicitly overrides it) or at the job level to specifically limit the permissions for that job. Since this workflow delegates all work to a single job via uses:, adding the block at the root is the simplest and most robust option.

Steps:

• Insert a permissions: block right after the name: field and before the on: trigger.
• Assign the most restrictive permissions possible to start (e.g., contents: read), and extend only if future operations require more.
• The edit only affects the .github/workflows/publish-dry-run.yml file, at the root/initial lines.

---

To address this problem, you should explicitly add a permissions block to the workflow. This can be done at the workflow root (which applies to all jobs not otherwise overridden) or at the job level. Since the workflow shown contains only one job (test), either location is appropriate. The minimal secure default is typically contents: read, which covers nearly all routine needs safely. If the underlying workflow requires more permissions (for example, pull-requests: write or similar), adjust as minimally as necessary, but you should not assume this unless documented. For now, the correct minimal change is to insert:

permissions:
  contents: read

immediately after the name: key and before the on: key (i.e., between line 15 and 16). This will limit the GITHUB_TOKEN scope for this workflow to only read operations on repository contents unless a job warrants higher privileges.

---