default perms

masl2 · nhsd-david-wass · commit 083f41cc9b05 · 2026-01-08T09:15:19.000Z
diff --git a/.github/workflows/stage-1-commit.yaml b/.github/workflows/stage-1-commit.yaml
@@ -36,6 +36,10 @@ on:
         required: true
         type: string
 
+
+permissions:
+  contents: read
+
 jobs:
   scan-secrets:
     name: "Scan secrets"
