GitHub Actions: set minimal job token permissions

Author: acdha

.github/workflows/coveralls.yml

@@ -1,22 +1,25 @@
 name: LibraryOfCongress/tests-bagit-python
+permissions:
+    contents: read
+
 on:
-  workflow_dispatch:
+    workflow_dispatch:
 jobs:
-  test:
-    runs-on: ubuntu-16.04
-    steps:
-    - name: checkout
-      uses: actions/checkout@v3.5.0
-    - uses: actions/setup-python@v4.6.0
-      with:
-        python-version: "${{ matrix.python }}"
-    - run: apt-get -y install gettext
-    - run: pip install --upgrade pip
-    - run: pip install coveralls coverage
-    - run: coverage run --include=bagit.py setup.py test
-    - run: coveralls
-      if: "${{ success() }}"
-    strategy:
-      matrix:
-        python:
-        - '3.10'
+    test:
+        runs-on: ubuntu-16.04
+        steps:
+            - name: checkout
+              uses: actions/checkout@v3.5.0
+            - uses: actions/setup-python@v4.6.0
+              with:
+                  python-version: "${{ matrix.python }}"
+            - run: apt-get -y install gettext
+            - run: pip install --upgrade pip
+            - run: pip install coveralls coverage
+            - run: coverage run --include=bagit.py setup.py test
+            - run: coveralls
+              if: "${{ success() }}"
+        strategy:
+            matrix:
+                python:
+                    - "3.10"

.github/workflows/pypi-release.yml

@@ -1,4 +1,6 @@
 name: "PyPI releases"
+permissions:
+    contents: read
 
 on: release
 

.github/workflows/test.yml

@@ -1,4 +1,6 @@
 name: Test
+permissions:
+    contents: read
 
 on:
     push:
@@ -20,7 +22,8 @@ jobs:
         strategy:
             fail-fast: false
             matrix:
-                python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
+                python-version:
+                    ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
         steps:
             - uses: actions/checkout@v4
             - name: Set up Python ${{ matrix.python-version }}