Add explicit permissions to corpus-integrity workflow for security #5

	# SPDX-FileCopyrightText: 2016-2026 PyThaiNLP Project
	# SPDX-License-Identifier: Apache-2.0

	name: Corpus Integrity Test

	on:
	push:
	paths:
	- ".github/workflows/corpus-integrity.yml"
	- "pythainlp/corpus/**"
	- "tests/corpus_integrity/**"
	pull_request:
	branches:
	- dev
	paths:
	- ".github/workflows/corpus-integrity.yml"
	- "pythainlp/corpus/**"
	- "tests/corpus_integrity/**"

	# Avoid duplicate runs for the same source branch and repository
	concurrency:
	group: >-
	${{ github.workflow }}-${{
	github.event.pull_request.head.repo.full_name \|\| github.repository
	}}-${{ github.head_ref \|\| github.ref_name }}
	cancel-in-progress: true

	jobs:
	corpus-integrity:
	runs-on: ubuntu-latest
	permissions:
	contents: read

	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Set up Python
	uses: actions/setup-python@v6
	with:
	python-version: "3.13"
	cache: "pip"

	- name: Install dependencies
	run: \|
	pip install --upgrade pip
	pip install .

	- name: Test built-in corpus files
	env:
	PYTHONIOENCODING: utf-8
	run: \|
	python -m unittest discover -s tests/corpus_integrity -p "test_builtin_*.py" -v

	- name: Test downloadable corpus files
	env:
	PYTHONIOENCODING: utf-8
	run: \|
	python -m unittest discover -s tests/corpus_integrity -p "test_downloadable_*.py" -v

Provide feedback