# Harden GitHub workflow permissions · screen/t3code-personal

[View on GitCafe](https://git.cafe/screen/t3code-personal/commit/556c42452c5ac94ae8d8698d64fcd372c1680955)

Repository: [screen/t3code-personal](https://git.cafe/screen/t3code-personal)

Visibility: public

Requested revision: 556c42452c5ac94ae8d8698d64fcd372c1680955

Requested commit: 556c42452c5ac94ae8d8698d64fcd372c1680955

Commit: 556c42452c5ac94ae8d8698d64fcd372c1680955

Tree: 32b139f94de1afc7fc71d900ad77417661727139

Author: Julius Marminge

Committer: Julius Marminge

## Message

```
Harden GitHub workflow permissions

- Restrict release workflow defaults to read-only access
- Grant `id-token` only to the publish job
- Document safe handling for `pull_request_target` in PR size checks

```

## Parents

- [7e20b23e7ea5dc1daf4cbfa65d61301d99168bae](https://git.cafe/screen/t3code-personal/commit/7e20b23e7ea5dc1daf4cbfa65d61301d99168bae?format=markdown)

[Source at this commit](https://git.cafe/screen/t3code-personal/tree/556c42452c5ac94ae8d8698d64fcd372c1680955?format=markdown)