From ae5ba141420cc6d03aaebb8c4b820dde12545f19 Mon Sep 17 00:00:00 2001
From: ApolloF <98666317+ApolloF@users.noreply.github.com>
Date: Sun, 1 Nov 2026 18:41:32 +0100
Subject: [PATCH] CI: read-only workflow token, write only for the release job

---
 .github/workflows/android.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 60b6065..6ff4ce0 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -6,8 +6,9 @@ on:
     tags: ["v*"]
   pull_request:
 
+# Every job gets a read-only token; only `release` publishes (it sets `contents: write` itself).
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   build:
@@ -72,6 +73,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     needs: [build, smoke]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # gh release create
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-java@v6