From cf8bcba31c51317f615d8a166615dd349a559430 Mon Sep 17 00:00:00 2001
From: Kobi Hikri <kobi.hikri@gmail.com>
Date: Tue, 14 Jul 2026 17:27:47 +0300
Subject: [PATCH] ci(FixPR): add explicit least-privilege permissions block

FixPR.yml had no permissions block, so GITHUB_TOKEN got the repo default.
It commits Cargo.lock back to main, so scope it to contents: write only.
Mirrors the hardening accepted in #12655.
---
 .github/workflows/FixPR.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/FixPR.yml b/.github/workflows/FixPR.yml
index 3807d6fe38e..aaca44294e1 100644
--- a/.github/workflows/FixPR.yml
+++ b/.github/workflows/FixPR.yml
@@ -7,6 +7,9 @@ name: FixPR
 env:
   BRANCH_TARGET: main
 
+permissions:
+  contents: write  # FixPR commits Cargo.lock back to main
+
 on:
   # * only trigger on pull request closed to specific branches
   # ref: https://github.community/t/trigger-workflow-only-on-pull-request-merge/17359/9