Update 8hobbies/workflows digest to 00e8456

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	7a5030f -> 00e8456

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

The best solution is to explicitly set the permissions key at the root of the workflow (global level), ensuring that any job (including the delegated lint job) runs with only the required permissions. For a linting workflow that checks code but does not need to modify the repo, the minimum safe value is likely contents: read. This should be added after the name: declaration and before the on: block (i.e., before any jobs or triggers), to reduce token privileges for all jobs unless overwritten.

No additional methods, imports, or variable definitions are needed. The only change is to add a YAML block.

---

To fix this problem, we should explicitly set the permissions block in the workflow file. The preferred location is at the root level, just after the name: and before the on: block, which will apply the permissions to all jobs unless overridden. The safest minimal setting is typically to restrict all permissions unless the workflow or its jobs require more for a specific reason. Since this workflow only includes a single job that calls a reusable workflow, and it likely doesn't need write access, the best practice is to set permissions: {} at the root. This sets all permissions to none. If future jobs need more, they can override at the job level.

No additional methods, imports, or definitions are needed: just insertion of a simple YAML block.

---

To fix this problem, you should add an explicit permissions: block to the workflow file, specifying only the required permissions for jobs in this workflow. The safest minimal starting point is contents: read, meaning the workflow can only read repository contents by default, which is generally sufficient for CI, linting, and test jobs that do not need to write back to the repo or interact with issues.

Add the following block immediately after name: and before on: in .github/workflows/runtime.yml:

permissions:
  contents: read

This ensures jobs run with read-only access and narrows the risk of accidental or malicious modification of repository state. If more permissions are needed by the underlying workflow or specific steps, they can be granted as needed—otherwise, read-only is safest.

To implement:

• Add the permissions block after the name: on line 15.
• No other code, methods, or dependencies are required.

---