more CI cleanup

Author: woodruffw

.github/workflows/conformance.yml

@@ -7,6 +7,8 @@ on:
   workflow_dispatch:
   pull_request:
 
+permissions: {}
+
 jobs:
   conformance:
     runs-on: ubuntu-latest

.github/workflows/docs.yml

@@ -5,6 +5,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/lint.yml

@@ -6,6 +6,8 @@ on:
       - main
   pull_request:
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -87,10 +89,10 @@ jobs:
     if: always()
 
     needs:
-    - lint
-    - check-readme
-    - licenses
-    - x509-testcases
+      - lint
+      - check-readme
+      - licenses
+      - x509-testcases
 
     runs-on: ubuntu-latest
 

.github/workflows/release.yml

@@ -5,8 +5,7 @@ on:
     types:
       - published
 
-permissions: # added using https://github.com/step-security/secure-workflows
-  contents: read
+permissions: {}
 
 jobs:
   build:
@@ -99,7 +98,7 @@ jobs:
       - name: Generate build provenance
         uses: actions/attest-build-provenance@v2
         with:
-          subject-path: 'built-packages/*'
+          subject-path: "built-packages/*"
 
   release-pypi:
     needs: [build, generate-provenance]

.github/workflows/requirements.yml

@@ -12,7 +12,9 @@ on:
         required: true
   pull_request:
   schedule:
-    - cron: '0 12 * * *'
+    - cron: "0 12 * * *"
+
+permissions: {}
 
 jobs:
   test_requirements:

.github/workflows/staging-tests.yml

@@ -5,7 +5,9 @@ on:
     branches:
       - main
   schedule:
-    - cron: '0 */8 * * *'
+    - cron: "0 */8 * * *"
+
+permissions: {}
 
 jobs:
   staging-tests:
@@ -27,7 +29,6 @@ jobs:
           cache: "pip"
           cache-dependency-path: pyproject.toml
 
-
       - name: staging tests
         env:
           SIGSTORE_LOGLEVEL: DEBUG