From 054b64508f2efa87685311d302d3d0b247c05426 Mon Sep 17 00:00:00 2001
From: Nikolaj Brask-Nielsen <nikolajgive@gmail.com>
Date: Thu, 27 Aug 2026 14:38:46 +0200
Subject: [PATCH 1/2] ci: reduce workflow permissions to minimum required

- build.yml: remove unused pull-requests: read permission
- docs.yml: scope pages:write and id-token:write to deploy job only;
  add missing name to checkout step
- release-please.yml: remove unused issues: write permission
---
 .github/workflows/build.yml          |  1 -
 .github/workflows/docs.yml           | 10 +++++++---
 .github/workflows/release-please.yml |  1 -
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c3a7bd6..411c207 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,7 +23,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
   build:
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 2adacc7..710ba37 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,8 +10,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 # Allow only one concurrent deployment
 concurrency:
@@ -21,8 +19,11 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       
       - name: Install, build, and upload your site
         uses: withastro/action@e84f40bd8d2caa9e768ec82ad30dd81f0b280853 # v6.1.2
@@ -38,6 +39,9 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      pages: write
+      id-token: write
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 03a86ff..3a7d596 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -6,7 +6,6 @@ on:
 
 permissions:
   contents: write
-  issues: write
   pull-requests: write
 
 jobs:

From 7c8deef6664e41aad61dd194febb48e5ebd32ec0 Mon Sep 17 00:00:00 2001
From: Nikolaj Brask-Nielsen <nikolajgive@gmail.com>
Date: Thu, 27 Aug 2026 14:45:03 +0200
Subject: [PATCH 2/2] ci: remove redundant job-level permissions in docs
 workflow

---
 .github/workflows/docs.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 710ba37..c392cd6 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -19,8 +19,6 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1