John Kennedy 8e81056d36 ci: add minimum workflow permissions (#51) ...

## Summary

- Add top-level `permissions: contents: read` to all four workflow files
(`ci.yml`, `_lint.yml`, `_test.yml`, `release.yml`) — fixes missing
permissions blocks (Rules 1 & 4)
- Remove `secrets: inherit` from `ci.yml` lint and test job calls — the
reusable workflows don't declare or use any secrets, so passing them in
a `pull_request`-triggered context exposed repo secrets to PR head
branch code (Rule 7)
- SHA-pin `pypa/gh-action-pypi-publish@release/v1` → `ed0c539` (Rule 6)
- SHA-pin `ncipollo/release-action@v1` → `339a818` (Rule 6)

## Test plan

- [x] CI passes on this PR (lint + test jobs still run correctly without
`secrets: inherit`)
- [x] Verify no workflow uses `secrets: inherit` or unpinned third-party
actions
- [x] Release workflow still has correct job-level escalation
(`id-token: write` on publish, `contents: write` on mark-release)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

2026-03-26 23:56:50 -07:00

..

actions/uv_setup

x

2025-03-17 23:34:39 -04:00

workflows

ci: add minimum workflow permissions (#51)

2026-03-26 23:56:50 -07:00