address security flag CKV2_GHA_1

sebsto · sebsto · commit 3998bc5e5c89 · 2025-09-27T11:34:58.000+02:00
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
@@ -8,6 +8,9 @@ on:
   pull_request:
     types: [opened, reopened, synchronize]
 
+# As per Checkov CKV2_GHA_1
+permissions: read-all
+
 jobs:
   soundness:
     name: Soundness
diff --git a/.gitignore b/.gitignore
@@ -11,3 +11,4 @@ DerivedData/
 .swiftpm/config/registries.json
 .swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata
 *key
+.ash
