Explicitly limit the permissions of workflows to read-only

Author: berland

.github/workflows/actionlint.yml

@@ -10,6 +10,8 @@ on:
 jobs:
   actionlint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: Download actionlint

.github/workflows/publish_to_pypi.yml

@@ -9,6 +9,8 @@ jobs:
   build-n-publish:
     name: Build and publish Python 🐍 distributions 📦 to PyPI
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/style.yml

@@ -14,6 +14,8 @@ jobs:
   lint:
     name: Linting through pre-commit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
       - name: Setup Python

.github/workflows/testing.yml

@@ -15,6 +15,8 @@ jobs:
   tests:
     name: "Python ${{ matrix.python-version }} on ${{ matrix.os }}"
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/typing.yml

@@ -13,6 +13,8 @@ env:
 jobs:
   type-checking:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     timeout-minutes: 15
     strategy:
       matrix: