icns

commit 3e85d61358e5c418fd6e7df5f3964a5c864855a1
parent b77d8f9375bcff3810c7b3604e1c247648838afc
Author: Jack Mordaunt <jackmordaunt.dev@gmail.com>
Date:   Sun, 20 Sep 2026 07:32:53 -0300

ci: leave the winget job without an ambient token

The job authenticates entirely with its own secret, so the token GitHub
injects was an unused credential sitting in the environment where a third
party action runs.

Diffstat:
M
.github/workflows/winget.yml
 | 
4
++++

1 file changed, 4 insertions(+), 0 deletions(-)
diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml
@@ -3,6 +3,10 @@ on:
   release:
     types: [released]
 
+# The action authenticates with a token of its own, so nothing here needs
+# the one GitHub injects.
+permissions: {}
+
 jobs:
   publish:
     runs-on: ubuntu-latest