From 3ffc3c438315c7685af41d118f167a9c3b5171c3 Mon Sep 17 00:00:00 2001
From: Arpit Jain <arpitjain099@gmail.com>
Date: Sun, 31 May 2026 10:12:23 +0900
Subject: [PATCH] ci: declare workflow-level contents: read on 1 workflow

Declares an explicit workflow-level permissions: contents: read on 1 workflow that currently inherit the default broad read-write GITHUB_TOKEN. Each file was inspected and only reads the checkout; none publish, push, or write via the GitHub API. Post-CVE-2025-30066 hardening default.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
---
 .github/workflows/backport.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 40119cf08..7466eb577 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -22,6 +22,10 @@ on:
       - closed
       - labeled
 
+
+permissions:
+  contents: read
+
 jobs:
   backport:
     runs-on: ubuntu-latest