permissions

.github/workflows/pull_request.yaml

@@ -28,15 +28,18 @@ jobs:
       MD_CONFIG: .github/md_config.json
       DOC_SRC: README.md
       MD_LINT_CONFIG: .markdownlint.yaml
+
   build:
+
+    permissions:
+      contents: read
+
     runs-on: ubuntu-latest
     name: Build
-    if: "! contains(toJSON(github.event.commits.*.message), '[skip-ci]')"
     steps:
     - name: Check out code
       uses: actions/checkout@v4
       with:
-        token: ${{ secrets.STAKATER_GITHUB_TOKEN }}
         ref: ${{github.event.pull_request.head.sha}}
         fetch-depth: 0
 

.github/workflows/push.yaml

@@ -17,6 +17,10 @@ env:
 
 jobs:
   build:
+
+    permissions:
+      contents: read
+
     name: Build
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest

.github/workflows/release.yaml

@@ -15,6 +15,10 @@ env:
 
 jobs:
   build:
+
+    permissions:
+      contents: read
+
     name: GoReleaser build
     runs-on: ubuntu-latest