Restrict Permissions in Github Workflows

.github/workflows/add-issue-to-project.yml

@@ -5,6 +5,8 @@ on:
     types:
       - opened
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add issue to project

.github/workflows/pre-commit-ci.yml

@@ -10,13 +10,18 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 jobs:
   pre-commit-ci:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v7
       with:
-        fetch-depth: 0 
+        fetch-depth: 0
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v7
       with:

.github/workflows/smoke-test.yml

@@ -14,6 +14,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
@@ -24,6 +27,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v7
       with:

.github/workflows/testing-and-coverage.yml

@@ -10,6 +10,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
@@ -22,6 +25,7 @@ jobs:
     - uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v7
       with:

python-project-template/.github/workflows/pre-commit-ci.yml.jinja

@@ -10,13 +10,18 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 jobs:
   pre-commit-ci:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v7
       with:
-        fetch-depth: 0 
+        fetch-depth: 0
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v7
       with:

python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja

@@ -24,6 +24,8 @@ jobs:
       id-token: write
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python
       uses: actions/setup-python@v7
       with:

python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja

@@ -14,16 +14,22 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: {{ python_versions }}
 
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
       uses: actions/setup-python@v7
       with:

python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja

@@ -10,16 +10,23 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: {{ python_versions }}
 
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
       uses: actions/setup-python@v7
       with:
@@ -43,6 +50,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python {{ py.min(python_versions)  }}
       uses: actions/setup-python@v7
       with:

python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja

@@ -8,6 +8,8 @@ on:
   push:
     branches: [ main ]
 
+permissions: {}
+
 env:
 {%- endraw %}
 {%- import 'python-versions.jinja' as py%}
@@ -37,6 +39,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Install dependencies
       run: pip install asv[virtualenv]==${{env.ASV_VERSION}}
     - name: Configure git
@@ -47,7 +50,7 @@ jobs:
       run: asv machine --machine gh-runner --yes
     - name: Fetch previous results from the "benchmarks" branch
       run: |
-        if git ls-remote --exit-code origin benchmarks > /dev/null 2>&1; then
+        if git show-ref --verify --quiet refs/remotes/origin/benchmarks; then
           git merge origin/benchmarks \
             --allow-unrelated-histories \
             --no-commit

python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja

@@ -8,7 +8,9 @@ on:
   schedule:
     - cron: 45 6 * * *
   workflow_dispatch:
-
+
+permissions: {}
+
 env:
 {%- endraw %}
 {%- import 'python-versions.jinja' as py%}
@@ -21,6 +23,8 @@ env:
 jobs:
   asv-nightly:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     defaults:
       run:
         working-directory: ${{env.WORKING_DIR}}
@@ -33,6 +37,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Install dependencies
       run: pip install asv[virtualenv]==${{env.ASV_VERSION}}
     - name: Configure git
@@ -43,7 +48,7 @@ jobs:
       run: asv machine --machine gh-runner --yes
     - name: Fetch previous results from the "benchmarks" branch
       run: |
-        if git ls-remote --exit-code origin benchmarks > /dev/null 2>&1; then
+        if git show-ref --verify --quiet refs/remotes/origin/benchmarks; then
           git merge origin/benchmarks \
             --allow-unrelated-histories \
             --no-commit

python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja

@@ -11,6 +11,8 @@ on:
     branches: [ main ]
   workflow_dispatch:
 
+permissions: {}
+
 concurrency:
   group: ${{github.workflow}}-${{github.ref}}
   cancel-in-progress: true
@@ -27,6 +29,9 @@ env:
 jobs:
   asv-pr:
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
     defaults:
       run:
         working-directory: ${{env.WORKING_DIR}}
@@ -39,6 +44,7 @@ jobs:
       uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false
     - name: Display Workflow Run Information
       run: |
         echo "Workflow Run ID: ${{github.run_id}}"

python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja

@@ -10,13 +10,16 @@ on:
     workflows: ["Run benchmarks for PR"]
     types: [completed]
 
+permissions: {}
+
 jobs:
   upload-pr-comment:
     runs-on: ubuntu-latest
     if: >
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
     permissions:
+      actions: read
       issues: write
       pull-requests: write
     steps:

python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja

@@ -10,17 +10,22 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions: {}
+
 concurrency:
   group: {% raw %}${{ github.workflow }}-${{ github.ref }}{% endraw %}
   cancel-in-progress: true
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: Set up Python {{ py.pref(python_versions) }}
       uses: actions/setup-python@v7
       with: