Update 8hobbies/workflows digest to aeea4ef

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	6ffa892 -> aeea4ef

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

To fix this issue, we need to add a permissions block specifying the minimum required permissions for the workflow at the root level of .github/workflows/lint.yml. Since the workflow only calls a reusable workflow to lint code (which typically only requires read access to repository contents), we can start with the recommended minimal configuration:

permissions:
  contents: read

This block should be placed directly under the name: key (line 13) but before the on: key (line 15) for clarity and convention.

To fix the problem, we should add an explicit permissions block at the root of the workflow configuration (top-level, right below name:), which will apply to all jobs (unless they override it). Since this workflow is running a dry-run publish and there are no clues in the provided snippet about any tokens requiring special privileges, the safest general default is permissions: contents: read. This will allow the workflow to clone/fetch code, but not to push code, create releases, or do anything with escalated privileges. If, after further inspection, more permissions (such as packages: write) are needed, they can be added later; but starting with the most restrictive set is safest.

To implement this, insert the following code after the name: declaration:

permissions:
  contents: read

This should occur right above the on: block, e.g., on line 14 or 15.

---

To fix this problem, add a permissions: block to the workflow, so that jobs triggered by this workflow do not inherit broad default permissions. The block should be placed at the root level (between name:/on: and jobs:), unless individual jobs require tailored permissions (in which case those jobs would declare them explicitly). As a starting point, set contents: read, which is the recommended minimal permission for most workflows. If a job requires more (such as pull-requests: write), add only those specific permissions. In this case, as the job is simply using a reusable workflow and there is no evidence of a need for write permissions, set contents: read at the root level in .github/workflows/runtime.yml, after the name: and before the on: section.