[mariokresic]

Summary

• Declare contents: read on .github/workflows/main-ci.yml so the workflow token no longer inherits the repository default.
• Checkout is the only GitHub API use in this workflow. The pnpm cache step continues to use the Actions cache token.

Test plan

• Confirm the workflow YAML parses and permissions is set at the workflow root
• After merge, confirm the next code scan clears actions/missing-workflow-permissions for .github/workflows/main-ci.yml

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: microblink/web-sdks
• Branch: fix/improve-gha-permissions
• File: .coderabbit.yaml
• Commit: 9cbc885
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8323b89e-044a-4e0b-8b31-d1ce9944f80c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}