From 86d05a12f7e8542eca0478efd48ab1f694a664df Mon Sep 17 00:00:00 2001
From: Maciej Kisiel <mkisiel@google.com>
Date: Thu, 19 Feb 2026 16:08:40 +0100
Subject: [PATCH] chore: update publish-docs permissions to be more targeted.
 (#812)

This is recommended by OSSF.
---
 .github/workflows/publish-docs.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-docs.yml b/.github/workflows/publish-docs.yml
index b844bd0..c45111f 100644
--- a/.github/workflows/publish-docs.yml
+++ b/.github/workflows/publish-docs.yml
@@ -5,11 +5,12 @@ on:
     types: [published]
   workflow_dispatch:
 
-permissions:
-  contents: write
+permissions: read-all
 
 jobs:
   deploy:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Check out code