CI: Restrict default permissions

Reduces risk of arbitrary code is run by attacker.

Author: tacaswell

.github/.github/workflows/lighthouse.yml

@@ -1,4 +1,6 @@
 name: Lighthouse
+permissions:
+  contents: read
 on: [push, pull_request]
 jobs:
   CI:

.github/.github/workflows/pre-commit.yaml

@@ -1,4 +1,6 @@
 name: Linting
+permissions:
+  contents: read
 
 on:
   push:

.github/.github/workflows/publish-pypi.yml

@@ -1,4 +1,6 @@
 name: Push to PyPI
+permissions:
+  contents: read
 
 on:
   push:
@@ -8,7 +10,10 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
-
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v1

.github/workflows/lint.yml

@@ -1,6 +1,8 @@
 ---
 
 name: Linting
+permissions:
+  contents: read
 on: [pull_request]
 
 permissions:

.github/workflows/release.yml

@@ -1,6 +1,8 @@
 ---
 
 name: Release
+permissions:
+  contents: read
 on:
   release:
     types: