From 5a5e097b06089b3ea90ab7f812fa7524f5c62419 Mon Sep 17 00:00:00 2001 From: William Storey Date: Thu, 11 Jun 2026 16:14:08 +0000 Subject: [PATCH] Restrict links workflow to contents: read zizmor flags the linkChecker job for excessive-permissions: with no permissions block it inherits the default broad token. The workflow only checks out the repo and runs a link checker, so contents: read is sufficient. Co-Authored-By: Claude Fable 5 --- .github/workflows/links.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml index f9da950b0..b771d1ad1 100644 --- a/.github/workflows/links.yml +++ b/.github/workflows/links.yml @@ -1,4 +1,6 @@ name: Links +permissions: + contents: read on: push: