From 3e9c7c2efa87928a9f800d8f48d82404d23956ee Mon Sep 17 00:00:00 2001
From: Dang Pham <phamnhathaidang@gmail.com>
Date: Fri, 14 Aug 2026 15:51:28 +0700
Subject: [PATCH] chore(actions): enforce minimal workflow permissions

Enable zizmor's excessive-permissions audit and deny workflow token permissions by default in the release workflow. Jobs that publish or create releases keep only their explicitly required permissions.

Fixes cpplint/cpplint#466.
---
 .github/workflows/release.yml | 2 ++
 zizmor.yml                    | 3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)
 delete mode 100644 zizmor.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c3a3749..4bcf390 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,6 +2,8 @@ name: Publish Python 🐍 distribution 📦 to PyPI and TestPyPI
 
 on: push
 
+permissions: {}
+
 jobs:
   build:
     name: Build distribution 📦
diff --git a/zizmor.yml b/zizmor.yml
deleted file mode 100644
index ee110b0..0000000
--- a/zizmor.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-rules:
-  excessive-permissions:
-    disable: true