From 733b76efeaea6f74c2ed6283738a88c064d5ccf9 Mon Sep 17 00:00:00 2001
From: Chandler Carruth <chandlerc@gmail.com>
Date: Fri, 24 Apr 2026 02:03:41 +0000
Subject: [PATCH] Add a permissions restriction

Assisted-by: Antigravity with Gemini
---
 .github/workflows/check_dependent.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/check_dependent.yaml b/.github/workflows/check_dependent.yaml
index 220a1da286bf..3cbb97d01c06 100644
--- a/.github/workflows/check_dependent.yaml
+++ b/.github/workflows/check_dependent.yaml
@@ -7,6 +7,10 @@ on:
   pull_request_target:
     types: [opened, synchronize, labeled, unlabeled]
 
+# This workflow runs as `pull_request_target` so that the check can't be
+# disabled or bypassed by a the PR, but it doesn't need any permissions.
+permissions: {}
+
 jobs:
   check_label:
     runs-on: ubuntu-latest