tidy: restrict permissions.

diff --git a/.github/workflows/tidy.yml b/.github/workflows/tidy.yml
index 824a461cf82e7ed57e920d04b469c4d5ef796a17..a6c9842d3fa6e0b4d24971087ae4c62b928aa1f3 100644 (file)
--- a/.github/workflows/tidy.yml
+++ b/.github/workflows/tidy.yml
@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.event_name }}-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{github.event_name == 'pull_request'}}
 
+permissions:
+  contents: read
+
 jobs:
   tidy:
     name: tidy