Update 8hobbies/workflows digest to 7a5030f

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	d98caf4 -> 7a5030f

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

The best way to fix the problem is to explicitly add a permissions block near the top of the workflow file .github/workflows/lint.yml to restrict the workflow’s access to only what is strictly necessary. Because this workflow appears to only run linting via a reusable workflow (with no indications of publishing, writing to issues, or PRs), the minimal required permission should be contents: read—which is the lowest required for most read-only tasks. You should add the following under the name field (above on:), unless your lint workflow specifically requires broader permissions. No other files need to be changed, and no imports are required.

To fix the problem, you should add a permissions block to the workflow, ideally at the root level, since only one job is declared. This block should explicitly restrict the GITHUB_TOKEN to only the permissions required by the workflow. As we do not know the exact requirements of the reusable workflow being invoked, the safest and recommended minimal starting point is contents: read, which only allows read access to repository content. If more permissions are needed, those can be added as required after consulting the documentation for the reusable workflow. The change should be done by inserting a permissions: section immediately after the name: field and before the on: section in the .github/workflows/publish-dry-run.yml file.

To fix this issue and meet best practices for GitHub Actions security, the workflow should be amended to explicitly set the permissions for the GITHUB_TOKEN.
The most robust and future-proof fix is to add a permissions block at the top level of the workflow (permissions: directly after name: but before on:), since this will apply the permissions setting to all jobs that do not have their own permissions.
Unless the job being called (via uses) requires more than read access, the minimal permission would be contents: read, meaning jobs can only read repository contents. If additional permissions are required by the reusable workflow, these can be adjusted accordingly (for example, granting pull-requests: write if writes to PRs are required).

Changes needed:

• Edit .github/workflows/runtime.yml and insert a block

  permissions:
    contents: read
  

  after the name: block and before on:
• No imports or additional dependencies are needed.

---