mirror of
https://github.com/lucide-icons/lucide.git
synced 2026-11-12 13:38:32 +00:00
Thibaud-Vdb
79d4dd48a7
Jobs without a permissions block inherit the repository default token scope. Scopes are derived from what each workflow actually does with the token: - the fourteen package build and test workflows plus the code linter never write through the token, they drop to contents: read. - lint-pr-title.yml gets pull-requests: read, which is what the semantic PR title action documents needing. - comment-icon-preview.yml runs on workflow_run, a privileged trigger processing artifacts produced by fork PRs, so an exact scope matters most there: actions: read to download the artifact, issues: write plus pull-requests: write to post the preview comment, contents: read for the rest. The workflows that already declared scoped permissions (labeler, stale, linting-icons, release and friends) are untouched.