Update 8hobbies/workflows digest to d98caf4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
8hobbies/workflows	action	digest	aeea4ef -> d98caf4

---

Configuration

📅 Schedule: Branch creation - "on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

The best fix is to add a permissions: block to the workflow, granting only those privileges required for the workflow to operate. Since the job only runs linting (and uses a reusable workflow) and does not appear to require any token-based write actions (such as creating issues or PRs, pushing code, etc.), the minimal permission would be read-only access to the repository contents. Thus, adding the following near the top of the workflow file, just after the name: declaration and before on:, ensures the workflow tokens are limited to the least privilege needed:

permissions:
  contents: read

If the reusable workflow needs more (e.g., to update PRs), this can be adjusted, but contents: read is correct as a minimal starting point.

Edit location:

• File: .github/workflows/lint.yml
• Insert after line 13 (after name: Lint and before on:).

---

To fix this issue, add a permissions: block to the workflow file (.github/workflows/publish-dry-run.yml). According to GitHub best practices, this block can be added at the root of the YAML (top-level, before jobs:), and should specify the minimum privileges necessary. In most cases, for a publish dry run or similar jobs, contents: read is sufficient unless greater permissions are strictly needed. If you are unsure, setting the permissions to contents: read will be a safe default. Add the following block after the name: and before the on: key.

---

To fix the problem, add an explicit permissions block to the workflow file. Since the job only references another reusable workflow, it is generally safest to add the permissions block at the workflow root (top level, alongside name, on, and jobs). The lowest privilege appropriate for most workflows is contents: read, which denies any write access to repository content, unless more privilege is needed. If you know the workflow or the reusable workflow needs additional permissions (like write access to issues or pull-requests), you should add only those specific write permissions. Since only the usage of another workflow is shown, we will add contents: read at the workflow root for minimal privilege.

Specifically, insert the following block under the name and before the on block:

permissions:
  contents: read

No methods, imports, or additional definitions are required; just update the YAML.

---