Update 8hobbies/workflows digest to 0addb4a

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	35aaff6 -> 0addb4a

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

To fix this issue, we should explicitly set the permissions key in the workflow YAML file. The minimal recommended permissions block is permissions: {} (no permissions), but typically lint jobs only require access to contents: read. Add the following at the top workflow level (applies to all jobs unless overridden), just after the name: Lint key. The edit should be made to .github/workflows/lint.yml after line 15. No other changes or dependencies are needed.

---

To fix this problem, we should add a permissions block at the top level of the workflow or directly in the job. The safest default is to use permissions: read-all, which restricts the GITHUB_TOKEN to read-only across all permissions. If the called reusable workflow requires any write permissions, they should be set more granularly, but since this is a dry run publish, read-only is almost certainly sufficient. The recommended change is to add the following block after the workflow's name: declaration and before the on: trigger, for clarity and consistency:

permissions:
  contents: read

This explicitly scopes the permissions to be as minimal as possible for typical workflows, unless more is required by the called reusable workflow.

---

To fix this problem, add a permissions block specifying least privilege at the top/root of the workflow file (globally for all jobs) or specifically under each job (here, there is only one job). Since this workflow delegates all work to the 8hobbies reusable workflow, we should use the most restrictive permissions unless more are required (in which case, delegated jobs will typically elevate as needed). The minimal, safest approach is to set permissions: {} (no access to the GITHUB_TOKEN) at the top/root level, which keeps the token as restricted as possible. Alternatively, if read access to repository contents is needed for the reusable workflow, set permissions: contents: read. Generally, permissions: {} is preferred for maximum security where no permissions are required at the delegator level.

Edit the .github/workflows/runtime.yml file by inserting a permissions: {} block after the name: line, ensuring all jobs have only the minimal permissions unless overridden. No new methods, imports, or definitions are needed.