Update 8hobbies/workflows digest to 05401f5

[renovate]

Coming soon: The Renovate bot (GitHub App) will be renamed to Mend. PRs from Renovate will soon appear from 'Mend'. Learn more here.

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	e113c9f -> 05401f5

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

To fix the problem, an explicit permissions block should be added to the workflow at the root level (before jobs:). This will limit the permissions granted to the GITHUB_TOKEN for all jobs, including the one that calls the reusable workflow. Since linting jobs typically require only minimal access, the best minimal starting point is:

permissions:
  contents: read

This restricts the workflow to only reading repository contents, which suffices for linting and does not allow write actions on contents, issues, or pull requests. The change should be made in .github/workflows/lint.yml by adding the block after the name: field and before the on: block.

No additional methods, imports, or definitions are needed—just this YAML block.

To resolve the issue, add an explicit permissions block to .github/workflows/publish-dry-run.yml at the top level, above jobs:. Since the workflow is primarily using a reusable workflow which likely interacts with repository contents (reading the code, perhaps reading secrets, but generally not needing to write unless publishing), start with a minimal permissions declaration such as contents: read. Additional write permissions should only be added if strictly necessary; if not, keep to least privilege. Insert the following at line 16 (just after the workflow name and before the on: trigger). No additional imports or modifications are required, only the addition of a permissions block.

---

To fix the problem, add a permissions block at the root of the workflow (.github/workflows/runtime.yml) to explicitly limit permissions of GITHUB_TOKEN. The least-privilege starting point is usually setting all permissions to read (e.g., contents: read). If the workflow or the reusable workflow requires more permissions (e.g., to create or modify issues, PRs), those specific keys may be set to write. As only the detected code snippet is available, we will add a root-level permissions block with contents: read—this is the CodeQL-recommended minimal starting point.

• Edit .github/workflows/runtime.yml
• Insert a root-level permissions block after the name: (line 15)
• Set contents: read unless context shows that broader permissions are required (not apparent here)
• No imports or external dependencies required