From cba60607a09b4097e6e2b1f284f1777223e36f05 Mon Sep 17 00:00:00 2001
From: Renn F <rennf93@users.noreply.github.com>
Date: Wed, 21 Oct 2026 02:30:11 +0200
Subject: [PATCH] ci(workflows): set a read-only default token permission

---
 .github/workflows/ci.yml             |  3 +++
 .github/workflows/scheduled-lint.yml | 22 ++++++++++++++--------
 .github/workflows/upstream-drift.yml |  6 +++++-
 3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b173669..10a954a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,6 +27,9 @@ on:
       - 'tests/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/scheduled-lint.yml b/.github/workflows/scheduled-lint.yml
index 9bd5a0c..c97f0b1 100644
--- a/.github/workflows/scheduled-lint.yml
+++ b/.github/workflows/scheduled-lint.yml
@@ -6,6 +6,9 @@ on:
     - cron: '0 9 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   scheduled-pre-commit:
     runs-on: ubuntu-latest
@@ -47,17 +50,20 @@ jobs:
       - name: Run markdown checks
         id: markdown
         run: |
-          pymarkdownlnt scan docs > markdown_output.txt 2>&1
-          EXIT_CODE=$?
+          EXIT_CODE=0
+          pymarkdownlnt scan docs > markdown_output.txt 2>&1 || EXIT_CODE=$?
 
           OUTPUT=$(cat markdown_output.txt)
-          echo "output<<EOF" >> $GITHUB_OUTPUT
-          echo "$OUTPUT" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
+          echo "$OUTPUT"
+          {
+            echo "output<<EOF"
+            echo "$OUTPUT"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
-          if [ $EXIT_CODE -eq 0 ]; then
-            echo "status=success" >> $GITHUB_OUTPUT
+          if [ "$EXIT_CODE" -eq 0 ]; then
+            echo "status=success" >> "$GITHUB_OUTPUT"
           else
-            echo "status=failed" >> $GITHUB_OUTPUT
+            echo "status=failed" >> "$GITHUB_OUTPUT"
             exit 1
           fi
diff --git a/.github/workflows/upstream-drift.yml b/.github/workflows/upstream-drift.yml
index 954fa7a..520059c 100644
--- a/.github/workflows/upstream-drift.yml
+++ b/.github/workflows/upstream-drift.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 3 * * *'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   drift:
     name: Test against guard-core@master
@@ -56,7 +59,8 @@ jobs:
 
       - name: Force-install the guard-core@master wheel over the resolved one
         run: |
-          wheel=$(ls wheels/guard_core-*.whl | head -n 1)
+          wheels=(wheels/guard_core-*.whl)
+          wheel="${wheels[0]}"
           uv pip install --python .venv/bin/python --no-deps --force-reinstall "$wheel"
 
       - name: Run the djapi-guard test suite against guard-core@master