From e3e2c5819a1f13da0fc80dee00442e9dc2bbc0bf Mon Sep 17 00:00:00 2001
From: cplieger <917744+cplieger@users.noreply.github.com>
Date: Fri, 9 Oct 2026 23:55:42 +0200
Subject: [PATCH] ci: grant security-events to the meta workflow call

---
 .github/workflows/ci.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e0e5b70..5057938 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -21,4 +21,9 @@ permissions:
 
 jobs:
   ci:
+    # The meta workflow's dead-code job uploads SARIF, and a called job cannot
+    # request more than its caller grants.
+    permissions:
+      contents: read
+      security-events: write
     uses: cplieger/ci/.github/workflows/ci.yaml@a6773a5247bda97b0b845423eba560586890470d # v3