add token permissions to github actions

.github/workflows/build.yml

@@ -1,5 +1,8 @@
 name: Build and test Python package
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/cffconvert.yml

@@ -1,5 +1,8 @@
 name: cffconvert
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/format-typing-check.yml

@@ -1,5 +1,8 @@
 name: Check format and static typing
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/markdown-link-check.yml

@@ -1,5 +1,8 @@
 name: markdown-link-check
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

.github/workflows/publish_gh_release.yml

@@ -1,6 +1,13 @@
 name: Draft or publish Github release
 # this action will automatically create a tag for the latest commit
 
+permissions:
+  actions: write
+  contents: write
+  packages: write
+  pull-requests: write
+  statuses: read
+
 on:
   workflow_dispatch:
     inputs:

.github/workflows/sonar-cloud.yml

@@ -1,5 +1,7 @@
 name: Check coverage
 
+permissions: read-all
+
 on:
   push:
     branches: