John Kennedy 8a05638338 fix: enforce least-privilege permissions on all workflows (#126) ...

## Summary
- Add top-level `permissions: contents: read` to 6 workflows that were
missing explicit permission declarations (defaulting to overly broad
token scopes)
- Narrow the `permissions: write-all` on the `test-pypi-publish` job in
`_release.yml` to `id-token: write`, which is all trusted PyPI
publishing requires
- `_codespell.yml` already had correct permissions and was left
unchanged

## Test plan
- [ ] Verify CI passes on this PR (lint, test, compile-integration-test
workflows all only need read access)
- [ ] Verify release workflow still works on next release (job-level
`id-token: write` and `contents: write` are preserved where needed)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-25 16:37:11 -08:00

..

actions/poetry_setup

update poetry version (#78)

2025-05-29 20:33:47 +08:00

ISSUE_TEMPLATE

Update issue templates (#45)

2025-02-28 15:42:01 +08:00

scripts

add apikey setup script for release workflow (#116)

2025-12-04 20:25:02 +08:00

workflows

fix: enforce least-privilege permissions on all workflows (#126)

2026-02-25 16:37:11 -08:00