🔄 Synced file(s) with ottrproject/OTTR_Template

[jhudsl-robot]

Synced local file(s) with ottrproject/OTTR_Template.

Changed files

• Synced local config_automation.yml with remote config_automation.yml
• Synced local .github/workflows/send-updates.yml with remote .github/workflows/send-updates.yml
• Synced local .github/workflows/test-send-updates.yml with remote .github/workflows/test-send-updates.yml
• Synced local .github/switch_sync_repo.R with remote .github/switch_sync_repo.R

---

This PR was created automatically by the repo-file-sync-action workflow run #15498355326

[jhudsl-robot]

Please carefully review these changes and decide which are useful for your course.
See the release notes: https://github.com/jhudsl/OTTR_Template/releases

• If you don't want the changes from a particular file, you can always revert that particular commit before merging the sync PR.
  If you will not want any updates on this file in the future, you may want to remove a file from being synced in your repo by reconfiguring the sync file.

• If you want only some changes, but they are not on a whole file basis, you could check out the branch and make manual edits. To checkout the branch, navigate to your own repository you should be able to run:

git checkout repo-sync/OTTR_Template/default

• If you don't want any of the changes you can close the PR entirely.

You may want to unenroll your repository from the sync GitHub actions by filing a PR on OTTR_Template
to delete your repo name from this file if this will continue to be the case.

To fix the problem, add an explicit permissions block that grants only the minimal scopes required. In this case, the style-code job must push commits back to the repository, so it needs contents: write. It does not appear to need any other scopes (no issues, PRs, workflows, etc.), so contents: write alone is sufficient.

The best change with minimal impact is to add a job-level permissions block under the style-code job definition, similar to what is already done for the ottr-reports job. This keeps other jobs unaffected and clearly documents that only this job needs write access to repository contents. No imports or additional definitions are needed because this is purely a YAML configuration change.

Concretely:

• Edit .github/workflows/pull_request.yml.
• In the style-code job (lines 88–105), insert:

    permissions:
      contents: write

• Place it after needs: yaml-check (or before runs-on:) so indentation and structure are consistent with the ottr-reports job’s existing permissions block.

In general, to fix this class of problem you add an explicit permissions: block either at the workflow root (applies to all jobs without their own permissions) or on the specific job that should have restricted permissions, and set only the scopes actually needed (often just contents: read).

For this workflow, there is already a permissions block on the ottr-reports job (with pull-requests: write), so we should not override that at the root. Instead, we will add a job-level permissions: block to the readability-report job so that its GITHUB_TOKEN is limited to read-only. The job checks out the repository and runs Rebilly/lexi@v2 with a github-token input; for analyzing files and posting results via the provided token, read access to repository contents is sufficient. Therefore, we will add:

    permissions:
      contents: read

immediately under runs-on: ubuntu-latest (line 117) in the readability-report job. No imports or other code changes are required.

[kweav]

Need to resolve conflicts and update render-both workflow