Update 8hobbies/workflows digest to aeea4ef

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	6ffa892 -> aeea4ef

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

To fix the issue, we should explicitly add a permissions key at the root of the workflow file (.github/workflows/lint.yml), just below the name: field (and above on:), specifying the minimal set of GitHub token permissions needed for this workflow. Since the workflow is strictly for linting and delegates all work to a reusable workflow, the safest/best choice is likely to set all permissions to read or to use the minimal starting point of permissions: {}
as recommended by CodeQL (which grants no access). If linting requires no writing (no PR creation, no issue writing), then contents: read will be sufficient as a common pattern. If the downstream workflow expects to update PRs, you might add pull-requests: write; but the secure default is to set contents: read.
Therefore, insert the following block after name: Lint:

permissions:
  contents: read

No methods/imports or other code changes are needed; this is a single block YAML addition.

To fix the issue, add a permissions block at the workflow root right under the name field (or, optionally, under the jobs.run block if granular job-level control is needed). Since the workflow is for a "Publish Dry Run" and only calls a reusable workflow, it probably does not need broad write access. Unless the underlying reusable workflow requires more, the safest minimal value is contents: read (the lowest permissions for most operations). If the reusable workflow needs more, the permissions should be increased per its documentation. For now, to follow the minimal starting point as per the CodeQL recommendation, add:

permissions:
  contents: read

right after the name field. No imports, methods, or definitions are required since this is a YAML configuration change.

To fix this problem, you should explicitly declare a permissions block at the top level of the workflow (beneath the name: but before on: or jobs:), or inside each job. Since this workflow delegates all logic to a single job (test), the minimal and most effective fix is to add a root-level permissions key. If you are unsure which permissions are required, the default safe setting is permissions: { contents: read }. Build on this if the reusable workflow needs additional write permissions (e.g., for pull requests), but in the absence of such requirements, contents: read is the safest baseline.

You must:

• Insert the following lines after name: Runtime on line 15:

permissions:
  contents: read

This grants the GITHUB_TOKEN only read access to repository contents for every job unless a job overrides it.

---