ci: tighten workflow token permissions

.github/workflows/audit.yml

@@ -10,7 +10,6 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -19,6 +18,9 @@ concurrency:
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/codeql.yml

@@ -9,9 +9,7 @@ on:
     - cron: "23 9 * * 1"
 
 permissions:
-  actions: read
   contents: read
-  security-events: write
 
 concurrency:
   group: codeql-${{ github.ref }}
@@ -22,6 +20,10 @@ jobs:
     name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
 
     strategy:
       fail-fast: false

.github/workflows/proof-pr.yml

@@ -9,7 +9,7 @@ permissions:
 
 jobs:
   proof:
-    uses: saagpatel/proof-pr/.github/workflows/proof-pr-receipt.yml@194f0864a1f17374d27bcc11e7d26a65bba2ffb3
+    uses: saagpatel/proof-pr/.github/workflows/proof-pr-receipt.yml@194f0864a1f17374d27bcc11e7d26a65bba2ffb3 # v0.2.14
     with:
       receipt_path: proof-pr.json
       proof_pr_ref: 194f0864a1f17374d27bcc11e7d26a65bba2ffb3

.github/workflows/pypi.yml

@@ -7,6 +7,9 @@ on:
         description: "Release tag to publish, for example v0.1.1"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build distributions

.github/workflows/release.yml

@@ -6,12 +6,14 @@ on:
       - "v*"
 
 permissions:
-  contents: write  # required for softprops/action-gh-release
+  contents: read
 
 jobs:
   build-and-release:
     name: Build dist artifacts and create GitHub Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write  # required for softprops/action-gh-release
 
     steps:
       - name: Checkout