From b9787d423e8af674a4645b43adf4f2df00ef1191 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Thu, 14 May 2026 10:32:56 +0900 Subject: [PATCH] ci: declare contents:read on CI workflow CI runs three notebook-only jobs (nbfmt, nblint, outputs-removed) against the diff. None touch the GitHub API beyond actions/checkout. contents:read is the minimum. Matches the per-job permissions blocks already used in notebook-pr-bot.yml and the workflow-level scopes documented in build-and-deploy.yml. Signed-off-by: Arpit Jain --- .github/workflows/ci.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index d50aa5d37bb..f8626f5eff2 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -6,6 +6,9 @@ on: paths: - "site/en/**" +permissions: + contents: read + jobs: nbfmt: name: Notebook format