From ae077605bb747613c3e634e1965f37b78671aa23 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 10 Oct 2026 12:17:30 +0000
Subject: [PATCH 1/2] Pin GitHub Actions to Ubuntu 24.04

Co-authored-by: SteveWinward <2002602+SteveWinward@users.noreply.github.com>
---
 .github/workflows/main_build.yml    | 2 +-
 .github/workflows/release_build.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main_build.yml b/.github/workflows/main_build.yml
index d14ac01..686467f 100644
--- a/.github/workflows/main_build.yml
+++ b/.github/workflows/main_build.yml
@@ -11,7 +11,7 @@ on:
 jobs:
   build:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     defaults:
       run:
         working-directory: 'src'
diff --git a/.github/workflows/release_build.yml b/.github/workflows/release_build.yml
index 59269af..0dc3262 100644
--- a/.github/workflows/release_build.yml
+++ b/.github/workflows/release_build.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
   build:
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
       # Required for NuGet trusted publishing (OIDC)

From 4e9495df8f623253c31e5b1d3daa3fe6d18bad76 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 10 Oct 2026 12:18:40 +0000
Subject: [PATCH 2/2] Restrict main workflow token permissions

Co-authored-by: SteveWinward <2002602+SteveWinward@users.noreply.github.com>
---
 .github/workflows/main_build.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/main_build.yml b/.github/workflows/main_build.yml
index 686467f..c3b4028 100644
--- a/.github/workflows/main_build.yml
+++ b/.github/workflows/main_build.yml
@@ -8,6 +8,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   build: