Fix testing permissions (#2517)

Author: daquinteroflex

.github/workflows/run_tests.yml

@@ -22,6 +22,10 @@ on:
   pull_request_review:
     types: [submitted]
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   determine-test-scope:
     runs-on: [ deploynode ]
@@ -185,12 +189,8 @@ jobs:
         echo "total=$TOTAL_COVERAGE" >> "$GITHUB_ENV"
         echo "### Total coverage: ${TOTAL_COVERAGE}%"
 
-    - name: verify-coverage-report-location
-      run: |
-        ls $GITHUB_WORKSPACE
-
     - name: Produce the diff coverage report
-      if: matrix.python-version == '3.13'
+      if: matrix.python-version == '3.13' && github.event_name == 'pull_request'
       run: |
         source ${GITHUB_WORKSPACE}/.venv/bin/activate
         git config --global --add safe.directory ${GITHUB_WORKSPACE}
@@ -199,7 +199,7 @@ jobs:
           --format markdown:diff-coverage.md
 
     - uses: actions/github-script@v7
-      if: matrix.python-version == '3.13'
+      if: matrix.python-version == '3.13' && github.event_name == 'pull_request'
       with:
         result-encoding: string
         script: |