From 676871a0033353bda9ee10f70e8f63da528dafe7 Mon Sep 17 00:00:00 2001
From: yuli <stremovsky@gmail.com>
Date: Mon, 13 Jul 2026 20:00:36 +0300
Subject: [PATCH] ci: declare least-privilege token permissions

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/maven.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index f70784b..d3c2f2f 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -18,6 +18,12 @@ on:
         default: false
         type: boolean
 
+# Least privilege. `mvn deploy` to GitHub Packages needs packages:write; nothing here
+# needs write to repo contents.
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build:
     runs-on: ubuntu-latest