mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-11-13 22:32:19 +00:00
ci.yml had no permissions block, so its token got the repository default. Its jobs only check out code, restore caches and upload artifacts, so contents: read is enough. The permissions half of item 6 in #1114.