chore: add permissions to workflows run

Author: danfimov

.github/workflows/release.yml

@@ -8,20 +8,22 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment:
+      name: release
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v5
-
-      - name: Install uv with python
-        uses: astral-sh/setup-uv@v7
         with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
           python-version: "3.12"
-          enable-cache: true
-
-      - name: Set version from tag
-        run: uv version "${{ github.ref_name }}"
-
-      - name: Build artifacts
-        run: uv build
-
-      - name: Publish package
-        run: uv publish --token "${{ secrets.PYPI_TOKEN }}"
+          version: "latest"
+      - run: uv version "${GITHUB_REF_NAME}"
+      - run: uv build
+      - name: Release package
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
+        run: uv publish

.github/workflows/test.yml

@@ -8,26 +8,30 @@ on:
     paths-ignore:
       - '*.md'
 
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+
 
 jobs:
   lint:
     strategy:
       matrix:
-        cmd: ["black", "mypy", "ruff"]
+        cmd: ["black", "ruff", "mypy"]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
-
-
-      - name: Install uv with python
+        with:
+          persist-credentials: false
+      - id: setup-uv
         uses: astral-sh/setup-uv@v7
         with:
-          python-version: "3.12"
           enable-cache: true
-
-
-      - name: Install dependencies
+          cache-suffix: 3.11
+          version: "latest"
+          python-version: 3.11
+      - name: Install deps
         run: uv sync --all-extras
-
       - name: Run lint check
         run: uv run pre-commit run -a ${{ matrix.cmd }}