From f998a44acd2384de238721d3febddb76acedbca7 Mon Sep 17 00:00:00 2001
From: Paula Ruiz Rodriguez <50167687+Paururo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 22:20:47 +0200
Subject: [PATCH] Set least-privilege permissions on the Rust workflow

CodeQL's actions/missing-workflow-permissions flagged both jobs for leaving the GITHUB_TOKEN at its default scopes. Add a top-level contents: read block, which is all the checkout and build steps need.
---
 .github/workflows/rust.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index e998806..73d66c0 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -6,6 +6,11 @@ on:
   pull_request:
     branches: [ "main" ]
 
+# Least privilege: both jobs only check out the repository and build, so the
+# GITHUB_TOKEN needs nothing beyond read access to the contents.
+permissions:
+  contents: read
+
 env:
   CARGO_TERM_COLOR: always