From c46480e3d789ca90bd8368a8025d6a0ca121c45e Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Mon, 27 Jul 2026 13:31:01 -0400
Subject: [PATCH] ci(dependency-review): set explicit read-only GITHUB_TOKEN
 permissions

Resolves code-scanning alert 11 (actions/missing-workflow-permissions).
The callable workflow only needs contents: read.
---
 .github/workflows/dependency-review.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 2cd8119..0fa94ff 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -1,6 +1,8 @@
 name: Dependency Review
 on:
   pull_request:
+permissions:
+  contents: read
 jobs:
   review:
     uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main