From 5d7c97e6739f396259cddd3cc376d30fc24c4a2e Mon Sep 17 00:00:00 2001
From: James Watkins-Harvey <james.watkinsharvey@temporal.io>
Date: Thu, 4 Dec 2025 16:58:41 -0500
Subject: [PATCH] Restrict GHA ID Token permissions

---
 .github/workflows/validate.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 8079ec5..f27c6c4 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
@@ -15,7 +18,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Print build information
-        run: 'echo head_ref: ${{ github.head_ref }}, ref: ${{ github.ref }}, os: ${{ matrix.os }}'
+        run: "echo head_ref: ${{ github.head_ref }}, ref: ${{ github.ref }}, os: ${{ matrix.os }}"
 
       - uses: actions/checkout@v4