From 7c845ff498fd78009d1df60c029310e0395dfdff Mon Sep 17 00:00:00 2001
From: PJ <ipriyanshujain@gmail.com>
Date: Sat, 15 Aug 2026 12:46:49 +0530
Subject: [PATCH] ci: declare least-privilege permissions

none of the three declared any, so each got the repository default.
release.yml and docs.yml already do this. all three only check out,
build, test and upload artifacts.
---
 .github/workflows/ci.yml        | 3 +++
 .github/workflows/folio.yml     | 3 +++
 .github/workflows/replay-ui.yml | 3 +++
 3 files changed, 9 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2e17655..f4bef62 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/folio.yml b/.github/workflows/folio.yml
index 0578afd..d8d8c91 100644
--- a/.github/workflows/folio.yml
+++ b/.github/workflows/folio.yml
@@ -32,6 +32,9 @@ on:
         description: step budget override (0 = each job's calibrated budget)
         default: "0"
 
+permissions:
+  contents: read
+
 jobs:
   android:
     timeout-minutes: 90
diff --git a/.github/workflows/replay-ui.yml b/.github/workflows/replay-ui.yml
index 3b8cd60..e98497a 100644
--- a/.github/workflows/replay-ui.yml
+++ b/.github/workflows/replay-ui.yml
@@ -19,6 +19,9 @@ on:
         description: step budget for the dogfood run
         default: "80"
 
+permissions:
+  contents: read
+
 jobs:
   dogfood:
     timeout-minutes: 45