Thibaud-Vdb 79d4dd48a7 ci: declare least-privilege workflow permissions ...

Jobs without a permissions block inherit the repository default token
scope. Scopes are derived from what each workflow actually does with
the token:

- the fourteen package build and test workflows plus the code linter
  never write through the token, they drop to contents: read.
- lint-pr-title.yml gets pull-requests: read, which is what the
  semantic PR title action documents needing.
- comment-icon-preview.yml runs on workflow_run, a privileged trigger
  processing artifacts produced by fork PRs, so an exact scope matters
  most there: actions: read to download the artifact, issues: write
  plus pull-requests: write to post the preview comment, contents:
  read for the rest.

The workflows that already declared scoped permissions (labeler,
stale, linting-icons, release and friends) are untouched.

2026-08-05 11:06:37 +02:00

..

instructions

feat(copilot): remove incorrect spaces clause from copilot instructions (#4623)

2026-08-03 09:52:41 +02:00

ISSUE_TEMPLATE

chore(repo): Update issue templates and documentation for package ren… (#4379)

2026-05-15 17:55:33 +02:00

workflows

ci: declare least-privilege workflow permissions

2026-08-05 11:06:37 +02:00

copilot-instructions.md

feat(copilot): Adding copilot instructions (#4407)

2026-05-22 16:08:38 +02:00

FUNDING.yml

Create FUNDING.yml

2023-04-28 22:59:05 +02:00

labeler.yml

chore(repo): Update issue templates and documentation for package ren… (#4379)

2026-05-15 17:55:33 +02:00

pull_request_template.md

feat(docs): Add lab requirement in pull_request_template.md (#3651)

2026-07-25 13:13:01 +02:00