From 252e8f833d047e65fab9f3268cca7ad2695b75b7 Mon Sep 17 00:00:00 2001
From: Denis Kasak <dkasak@termina.org.uk>
Date: Mon, 6 Jul 2026 20:25:04 +0200
Subject: [PATCH] Fix broad permissions in the poetry_lockfile.yaml workflow

---
 .github/workflows/poetry_lockfile.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/poetry_lockfile.yaml b/.github/workflows/poetry_lockfile.yaml
index 856e51e7ab..eb4e162d39 100644
--- a/.github/workflows/poetry_lockfile.yaml
+++ b/.github/workflows/poetry_lockfile.yaml
@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check-sdists:
     name: "Check locked dependencies have sdists"