From d0cc18738c1c205afbf6b1e54a40fc97bf139aa1 Mon Sep 17 00:00:00 2001
From: Alb3e3 <74142887+Alb3e3@users.noreply.github.com>
Date: Sat, 27 Jun 2026 13:52:31 +0200
Subject: [PATCH] ci: set least-privilege GITHUB_TOKEN permissions for meson
 workflow

The meson workflow only builds and tests across platforms; none of its
jobs write to the repository, packages, or other GitHub resources. Add a
workflow-level `permissions: { contents: read }` block so the default
GITHUB_TOKEN follows least privilege instead of inheriting the broad
read/write scopes granted by default.
---
 .github/workflows/meson.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/meson.yml b/.github/workflows/meson.yml
index 8edad33..d85e876 100644
--- a/.github/workflows/meson.yml
+++ b/.github/workflows/meson.yml
@@ -6,6 +6,9 @@ concurrency:
   group: ${{github.workflow}}-${{github.head_ref}}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   Linux-GCC:
     runs-on: ubuntu-22.04
-- 
2.47.3