Update 8hobbies/workflows digest to d98caf4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	aeea4ef -> d98caf4

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

To fix the issue, we must add an explicit permissions block to the workflow file .github/workflows/lint.yml. Because the workflow only delegates jobs to a reusable workflow, the safest setting is global read-only access (the recommended starting point): permissions: contents: read. This should be placed at the root level, above the jobs: key, so it applies to all jobs unless overridden. No further changes are necessary, since the workflow does not appear to require write permissions for its own logic.

The most appropriate fix is to add a permissions: block to the workflow at the top level. This block should appear immediately under the name: field and before the on: field. The minimal, safest default is contents: read, which restricts the workflow to only being able to read repository contents, unless a more permissive setting is required. If the reusable workflow needs additional permissions, then you’d need to consider that, but the CodeQL recommendation is to start with the minimal. Therefore, add the following lines after line 15:

permissions:
  contents: read

This will ensure that, unless overridden in the reusable workflow or specific jobs, only read access is available.

---

To fix this issue, you should add a permissions: block specifying the least required privilege for the workflow. Since this workflow only triggers a reusable workflow for CI purposes and likely does not require write access to repository contents, the minimal safe block would be:

permissions:
  contents: read

This block should be placed at the top level, just below the name: key and above on:. If particular jobs required more permissions, you would set their permissions: blocks individually inside them, but here a minimal global block suffices. This change ensures the GITHUB_TOKEN will only have read-only access for repository contents during this workflow, reducing security risk.