fix: code review feedback

Author: rpocklin

.github/workflows/api-diff.yml

@@ -7,14 +7,15 @@ on:
       - master
       - main
 
-# Cancel in-progress runs for the same PR/branch
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   test-branch-logic:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
@@ -35,9 +36,6 @@ jobs:
       with:
         fetch-depth: 0
 
-    - name: Pull oasdiff Docker image
-      run: docker pull tufin/oasdiff:latest
-    
     - name: Make script executable
       run: chmod +x scripts/api-diff/api-diff.sh