address automated review

Author: blink1073

.github/workflows/test-python.yml

@@ -19,6 +19,8 @@ env:
 jobs:
   static:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v4
       with:
@@ -36,6 +38,8 @@ jobs:
     - run: just doctest
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
@@ -60,6 +64,8 @@ jobs:
 
   build-min:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v4
       with:

.github/zizmor.yml

@@ -3,5 +3,5 @@ rules:
     config:
       policies:
         actions/*: ref-pin
-        mongodb-labs/drivers-github-tools: ref-pin
-        "*": hash-pin
+        mongodb-labs/drivers-github-tools/*: ref-pin
+        mongodb-labs/drivers-evergreen-tools: ref-pin