chore: restrict GitHub workflow permissions - future-proof (#1)

* chore: restrict GitHub workflow permissions - future-proof

Signed-off-by: Melissa Kilby <mkilby@apple.com>

* chore: restrict GitHub workflow permissions - future-proof

Signed-off-by: Melissa Kilby <mkilby@apple.com>

---------

Signed-off-by: Melissa Kilby <mkilby@apple.com>

Author: incertum

.github/workflows/sphinx.yml

@@ -1,24 +1,20 @@
 name: Deploy sphinx site to Pages
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: ["main"]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
 concurrency:
   group: "pages"
   cancel-in-progress: false
 
 jobs:
   build:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v5
@@ -36,6 +32,9 @@ jobs:
           path: ./docs/build/html
 
   deploy:
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/testing.yml

@@ -1,5 +1,8 @@
 name: Run tests upon pull request events
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches: ["main"]