mirror of
https://github.com/uutils/coreutils.git
synced 2026-07-31 16:04:03 -04:00
FixPR.yml had no permissions block, so GITHUB_TOKEN got the repo default. It commits Cargo.lock back to main, so scope it to contents: write only. Mirrors the hardening accepted in #12655.