Restrict links workflow to contents: read

[horgh]

zizmor reports an excessive-permissions finding for the linkChecker job in links.yml: with no permissions: block it inherits the default broad token. The workflow only checks out the repo and runs a link checker, so this grants it the minimal contents: read at the workflow level (matching the style of precious.yml).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Enhanced internal security configuration for automated processes.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9f3b0890-2b74-41fc-ba6b-2f5de6b2b8c9

📥 Commits

Reviewing files that changed from the base of the PR and between 7e8765f and 5a5e097.

📒 Files selected for processing (1)

• .github/workflows/links.yml

---

📝 Walkthrough

Walkthrough

The links.yml GitHub Actions workflow is updated to declare explicit token permissions at the workflow level, restricting the default token access to read-only access of repository contents.

Changes

Workflow Token Permissions

Layer / File(s)	Summary
Workflow token permissions declaration .github/workflows/links.yml	A top-level permissions block is added to restrict the workflow token to contents: read access only.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A rabbit hops through security gates,
With tokens trimmed to their proper weight—
Read-only now, no more, no less,
GitHub workflows in fine finesse. 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: restricting the GitHub Actions workflow permissions to contents: read.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch wstorey/fix-zizmor

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}