SEC: force workflows to be read-only.

Via tidelift and suggested by
https://deps.dev/pypi/ipython

.github/workflows/docs.yml

@@ -1,36 +1,39 b''
 name: Build docs
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
     - uses: actions/checkout@v3
     - name: Set up Python
       uses: actions/setup-python@v4
       with:
         python-version: 3.x
     - name: Install Graphviz
       run: |
         sudo apt-get update
         sudo apt-get install graphviz
     - name: Install Python dependencies
       run: |
         python -m pip install --upgrade pip setuptools coverage rstvalidator
         pip install -r docs/requirements.txt
     - name: Build docs
       run: |
         python -m rstvalidator long_description.rst
         python tools/fixup_whats_new_pr.py
         make -C docs/ html SPHINXOPTS="-W" \
           PYTHON="coverage run -a" \
           SPHINXBUILD="coverage run -a -m sphinx.cmd.build"
     - name: Generate coverage xml
       run: |
         coverage combine `find . -name .coverage\*` && coverage xml
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@v2
       with:
         name: Docs

.github/workflows/downstream.yml

@@ -1,50 +1,52 b''
 name: Run Downstream tests
 
 on:
   push:
   pull_request:
   # Run weekly on Monday at 1:23 UTC
   schedule:
   - cron:  '23 1 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
 
 jobs:
   test:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         os: [ubuntu-latest]
         python-version: ["3.9"]
         include:
           - os: macos-latest
             python-version: "3.9"
 
     steps:
     - uses: actions/checkout@v3
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Update Python installer
       run: |
         python -m pip install --upgrade pip setuptools wheel
     - name: Install ipykernel
       run: |
         cd .. 
         git clone https://github.com/ipython/ipykernel
         cd ipykernel
         pip install -e .[test] 
         cd ..
     - name: Install and update Python dependencies
       run: |
         python -m pip install --upgrade -e file://$PWD#egg=ipython[test]
         # we must install IPython after ipykernel to get the right versions.
         python -m pip install --upgrade --upgrade-strategy eager flaky ipyparallel
         python -m pip install --upgrade 'pytest<7' 
     - name: pytest
       env:
         COLUMNS: 120
       run: |
         cd ../ipykernel
         pytest

.github/workflows/mypy.yml

@@ -1,34 +1,37 b''
 name: Run MyPy
 
 on:
   push:
     branches: [ main, 7.x]
   pull_request:
     branches: [ main, 7.x]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: [3.8]
 
     steps:
     - uses: actions/checkout@v3
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
         pip install mypy pyflakes flake8
     - name: Lint with mypy
       run: |
         mypy -p IPython.terminal
         mypy -p IPython.core.magics
     - name: Lint with pyflakes
       run: |
         flake8  IPython/core/magics/script.py
         flake8  IPython/core/magics/packaging.py

.github/workflows/python-package.yml

@@ -1,36 +1,39 b''
 # This workflow will install Python dependencies, run tests and lint with a variety of Python versions
 # For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions
 
 name: Python package
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main, 7.x ]
   pull_request:
     branches: [ main, 7.x ]
 
 jobs:
   formatting:
 
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
     - uses: actions/checkout@v3
       with:
         fetch-depth: 0
     - name: Set up Python
       uses: actions/setup-python@v4
       with:
         python-version: 3.x
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
         pip install darker black==21.12b0
     - name: Lint with darker
       run: |
         darker -r 60625f241f298b5039cb2debc365db38aa7bb522 --check --diff . || (
         echo "Changes need auto-formatting. Run:"
         echo "    darker -r 60625f241f298b5039cb2debc365db38aa7bb522"
         echo "then commit and push changes to fix."
         exit 1
         )