Tighten GHA permissions

[maresb]

Description

Related Issue

• Closes #
• Related to Update GitHub Actions SHAs and versions #7896

Checklist

• Checked that the pre-commit linting/style checks pass
• Included tests that prove the fix is effective or that the new feature works
• Added necessary documentation (docstrings and/or example notebooks)
• If you are a pro: each commit corresponds to a relevant logical change

Type of change

• New feature / enhancement
• Bug fix
• Documentation
• Maintenance
• Other (please specify):

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.49%. Comparing base (85a234a) to head (d22fc2d).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #7959   +/-   ##
=======================================
  Coverage   91.49%   91.49%           
=======================================
  Files         116      116           
  Lines       18962    18962           
=======================================
  Hits        17349    17349           
  Misses       1613     1613           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull Request Overview

This PR tightens GitHub Actions security by implementing the principle of least privilege for workflow permissions. The changes follow a "deny-by-default" approach by setting top-level permissions: {} and then explicitly granting only the required permissions at the job level.

Key changes:

• Added permissions: {} at the workflow level for all workflow files
• Removed unnecessary contents: read permission from the devcontainer-docker-image.yml job
• Refactored zizmor workflow to use the official zizmor-action instead of manual uvx execution
• Added cooldown configuration to dependabot to reduce update frequency

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	Refactored to use zizmor-action and tightened permissions with workflow-level permissions: {}
.github/workflows/tests.yml	Added workflow-level permissions: {} to enforce least privilege
.github/workflows/slash_dispatch.yml	Added workflow-level permissions: {} to enforce least privilege
.github/workflows/release.yml	Added workflow-level permissions: {} to enforce least privilege
.github/workflows/publish-release-notes-to-discourse.yml	Added workflow-level permissions: {} to enforce least privilege
.github/workflows/pr-auto-label.yml	Added workflow-level permissions: {} to enforce least privilege
.github/workflows/mypy.yml	Added workflow-level permissions: {} to enforce least privilege
.github/workflows/docker-image.yml	Added workflow-level permissions: {} to enforce least privilege
.github/workflows/devcontainer-docker-image.yml	Added workflow-level permissions: {} and removed unnecessary contents: read from job level
.github/dependabot.yml	Added 7-day cooldown to reduce dependabot update frequency

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The job uses actions/checkout (line 27) which requires contents: read permission. Without this permission, the checkout action may fail. Even though actions/checkout can work with default permissions in some contexts, explicitly removing contents: read when the workflow uses checkout is problematic. The workflow-level permissions: {} denies all permissions, so the job needs explicit contents: read to checkout the repository.

Suggested change

	permissions:
	permissions:
	contents: read

[maresb]

Clearly incorrect.

[williambdean]

Looks good from my side