tighten permissions

Author: Carreau

.github/workflows/ci.yml

@@ -15,6 +15,9 @@ defaults:
   run:
     shell: bash -eux {0}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}

.github/workflows/downstream.yml

@@ -9,6 +9,9 @@ concurrency:
   group: downstream-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   nbclient:
     runs-on: ubuntu-latest

.github/workflows/nightly.yml

@@ -8,6 +8,9 @@ defaults:
   run:
     shell: bash -eux {0}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: "ubuntu-latest"

.github/workflows/publish-changelog.yml

@@ -9,6 +9,9 @@ on:
         description: "The branch to target"
         required: false
 
+permissions:
+  contents: write
+
 jobs:
   publish_changelog:
     runs-on: ubuntu-latest
@@ -21,6 +24,8 @@ jobs:
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Publish changelog
         id: publish-changelog

.github/workflows/publish-release.yml

@@ -12,6 +12,9 @@ on:
         description: "Comma separated list of steps to skip"
         required: false
 
+permissions:
+  contents: write
+
 jobs:
   publish_release:
     runs-on: ubuntu-latest
@@ -26,6 +29,8 @@ jobs:
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Populate Release
         id: populate-release

.pre-commit-config.yaml

@@ -32,8 +32,8 @@ repos:
       - id: mdformat
         additional_dependencies: [mdformat-footnote]
 
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: "v4.0.0-alpha.8"
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: "v3.9.6"
     hooks:
       - id: prettier
         types_or: [yaml, html, json]