From ed2726f5886a8ddcc9a32900511761cbe691db72 Mon Sep 17 00:00:00 2001
From: Andrew Rowson <github@growse.com>
Date: Tue, 24 Sep 2024 09:04:23 +0100
Subject: [PATCH] fix(ci): add permissions to PR jobs

---
 .github/workflows/pull-requests.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/pull-requests.yaml b/.github/workflows/pull-requests.yaml
index 377549962c..f768e7d5cc 100644
--- a/.github/workflows/pull-requests.yaml
+++ b/.github/workflows/pull-requests.yaml
@@ -21,10 +21,16 @@ name: Pull Requests
 jobs:
   build-test-lint:
     name: Build, Test, and Lint
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/build-test-lint.yaml
     secrets: inherit
   espresso-test:
     name: Espresso Test
+    permissions:
+      contents: read
+      checks: write
     uses: ./.github/workflows/espresso.yaml
     secrets: inherit
     needs: