From cee3d6a5547e8a573fa1ffb3e6a3812e3e4b9c1b Mon Sep 17 00:00:00 2001
From: Melissa Kilby <mkilby@apple.com>
Date: Fri, 10 Oct 2025 14:22:19 -0700
Subject: [PATCH] chore: restrict GitHub workflow permissions

Signed-off-by: Melissa Kilby <mkilby@apple.com>
---
 .github/workflows/pull_request.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 1ed0a799..4a0f0046 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -1,4 +1,8 @@
 name: Build Docker images
+
+permissions:
+  contents: read
+
 on: [pull_request]
 
 env: