Clarify access rights

Author: MaxymVlasov

.github/workflows/ci-cd.yml

@@ -15,6 +15,9 @@ on:
   pull_request:
   workflow_call:  # a way to embed the main tests
 
+permissions:
+  contents: read
+
 concurrency:
   group: >-
     ${{

.github/workflows/pre-commit.yaml

@@ -2,7 +2,8 @@
 
 name: Common issues check
 
-on: [pull_request]
+on:
+  pull_request:
 
 permissions:
   contents: read

.github/workflows/release.yml

@@ -25,6 +25,8 @@ jobs:
       contents: write
       # for cycjimmy/semantic-release-action to write comments to issues
       issues: write
+      # for cycjimmy/semantic-release-action to write comments to PRs
+      pull-requests: write
 
     name: Release
     runs-on: ubuntu-latest

.github/workflows/reusable-tox.yml

@@ -83,6 +83,9 @@ on:
         description: Mandatory token for uploading to Codecov
         required: true
 
+permissions:
+  contents: read
+
 env:
   COLOR: >-  # Supposedly, pytest or coveragepy use this
     yes

.github/workflows/scheduled-runs.yml

@@ -10,6 +10,9 @@ on:
   - cron: 3 5 * * *  # run daily at 5:03 UTC
   workflow_dispatch:  # manual trigger
 
+permissions:
+  contents: read
+
 run-name: >-
   🌃
   Nightly run of