Summary

Validated the GitHub Actions workflow and added minimum required permissions following security best practices.

Changes

• Added permissions: contents: read at the workflow level in .github/workflows/check.yml

Security improvements

The workflow only needs to read repository contents (for actions/checkout). By explicitly setting permissions: contents: read, we:

• Prevent the GITHUB_TOKEN from having write access by default
• Restrict the token to only what is strictly needed
• Follow the principle of least privilege

Already correct

• All actions are pinned to full commit SHAs (not mutable tags) — prevents supply-chain attacks ✅
• runs-on: ubuntu-24.04 uses a specific runner version ✅