(mynewt-nimble) 18/19: ci: Add explicit least-privilege permissions to compliance workflow

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-nimble.git

commit 1e1b75f326d58dd5b42beb9acc4cb9b949b0ee5c
Author: Szymon Janc <sz...@codecoup.pl>
AuthorDate: Wed Oct 21 21:47:41 2026 +0200

    ci: Add explicit least-privilege permissions to compliance workflow
    
    Compliance workflow inherited the repository default GITHUB_TOKEN
    scope. It only checks out code and reads pull request labels, so
    declare read-only permissions explicitly, same as in
    apache-mynewt-core.
    
    Assisted-by: Claude:claude-opus-5-5
---
 .github/workflows/compliance_check.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/compliance_check.yml b/.github/workflows/compliance_check.yml
index 395bc2bc7..ea86934dd 100644
--- a/.github/workflows/compliance_check.yml
+++ b/.github/workflows/compliance_check.yml
@@ -27,6 +27,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
 jobs:
   style_check:
     name: Coding style