docs(workflows): document required caller permissions to prevent star… #17

	# actionlint reusable workflow.
	#
	# Recommended caller stanza:
	#
	# name: actionlint
	# on:
	# push:
	# branches: [main]
	# paths:
	# - .github/workflows/**
	# - .github/actions/**
	# pull_request:
	# branches: [main]
	# paths:
	# - .github/workflows/**
	# - .github/actions/**
	# jobs:
	# actionlint:
	# uses: openCoreEMR/github-workflows-public/.github/workflows/actionlint.yml@<tag>
	# permissions:
	# contents: read
	name: actionlint

	on:
	push:
	branches:
	- main
	paths:
	- .github/workflows/**
	- .github/actions/**
	pull_request:
	branches:
	- main
	paths:
	- .github/workflows/**
	- .github/actions/**
	workflow_call:
	inputs:
	runs-on:
	description: Runner label
	type: string
	default: ubuntu-latest

	permissions:
	contents: read

	jobs:
	actionlint:
	name: Lint GitHub Actions workflows
	runs-on: ${{ inputs.runs-on \|\| 'ubuntu-latest' }}

	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Run actionlint
	uses: rhysd/actionlint@v1.7.12

Provide feedback