From 468b8482748c74606ca3ea5e3aa19278f6fab693 Mon Sep 17 00:00:00 2001
From: Tomasz Naumowicz <tnaumowicz@microsoft.com>
Date: Thu, 22 Oct 2026 10:25:09 +0000
Subject: [PATCH] ci: limit API Extractor token to read-only contents

Declare the checkout permission explicitly instead of inheriting repository token defaults. Keep this fix scoped to API extraction; the other changes in #974 are obsolete on main.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/api-extractor.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/api-extractor.yaml b/.github/workflows/api-extractor.yaml
index c05e89108..49c2b77ed 100644
--- a/.github/workflows/api-extractor.yaml
+++ b/.github/workflows/api-extractor.yaml
@@ -12,6 +12,9 @@ on:
             - release/**
     pull_request:
 
+permissions:
+    contents: read
+
 concurrency:
     group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
     cancel-in-progress: true