Merge branch 'main' into transforms-docs-improvements

Author: isaacdevlugt

.github/workflows/assign_bugs.yml

@@ -6,6 +6,9 @@ on:
 jobs:
   autoassign:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: read
     steps:
       - uses: Naturalclar/issue-action@v2.0.2
         with:

.github/workflows/changelog_reminder.yml

@@ -7,9 +7,12 @@ name: Changelog Reminder
 jobs:
   remind:
     name: Changelog Reminder
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@v6
     - name: Changelog Reminder
       uses: peterjgrainger/action-changelog-reminder@v1.3.0
       with:

.github/workflows/check-external-contributor.yml

@@ -1,4 +1,7 @@
 name: External Contributor Check
+permissions:
+  contents: read
+  pull-requests: write
 on:
   pull_request_target:
     types: 

.github/workflows/check_in_artifact.yml

@@ -69,7 +69,9 @@ on:
 jobs:
   check_in_artifact:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout main
         uses: actions/checkout@v6

.github/workflows/code_security_scan.yml

@@ -1,4 +1,6 @@
 name: Code Security Scan
+permissions:
+  contents: read
 on:
   pull_request:
   push:

.github/workflows/determine-workflow-runner.yml

@@ -32,6 +32,8 @@ on:
 
 jobs:
   determine_workflow_runner:
+    permissions:
+      contents: read
     runs-on: >-
       ${{
         (

.github/workflows/format.yml

@@ -1,4 +1,6 @@
 name: Formatting check
+permissions:
+  contents: read
 on:
   merge_group:
     types:

.github/workflows/interface-dependency-versions.yml

@@ -4,6 +4,8 @@
 # This workflow maintains a single source of truth for the versions of these dependencies.
 
 name: Determine Package Versions to use for testing certain PennyLane Interfaces
+permissions:
+  contents: read
 on:
   workflow_call:
     inputs:

.github/workflows/interface-unit-tests.yml

@@ -6,6 +6,8 @@
 # The workflow utilizes matrix strategies to parallelize the test runs and supports skipping specific jobs on a lightened CI run.
 
 name: Unit Test - All Interfaces
+permissions:
+  contents: read
 on:
   workflow_call:
     secrets:

.github/workflows/module-validation.yml

@@ -1,4 +1,6 @@
 name: Validate module imports
+permissions:
+  contents: read
 
 on:
   merge_group: