chore(security): fix "Token-Permissions" rule for workflows

.github/workflows/dco.yaml

@@ -5,6 +5,10 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/publish-to-pypi.yml

@@ -5,6 +5,10 @@ on:
     tags:
       - "*"
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build:
     name: Build distribution
@@ -56,4 +60,3 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           verbose: true
-

.github/workflows/publish-to-test-pypi.yml

@@ -4,6 +4,10 @@ on:
   push:
     branches: ["main"]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build:
     name: Build distribution

.github/workflows/pyright.yml

@@ -1,11 +1,15 @@
 name: pyright
 
-on:
-  pull_request:
-    branches: ["main"]
-
-jobs:
-  type-check:
+on:
+  pull_request:
+    branches: ["main"]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  type-check:
     runs-on: ubuntu-latest
     strategy:
       matrix:

.github/workflows/pytest.yml

@@ -4,6 +4,10 @@ on:
   pull_request:
     branches: [ "main" ]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   uv-example:
     name: python
@@ -31,4 +35,3 @@ jobs:
       - name: Run tests
         run: |
           uv run pytest
-

.github/workflows/release-please.yml

@@ -6,16 +6,18 @@ on:
       - main
 
 permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+  contents: read
+  pull-requests: read
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           release-type: python
-

.github/workflows/ruff.yml

@@ -1,11 +1,15 @@
 name: ruff
 
-on:
-  pull_request:
-    branches: [ "main" ]
-
-jobs:
-  lint:
+on:
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint:
     runs-on: ubuntu-latest
     strategy:
       matrix: