Merge branch 'main' into alert-autofix-6

.github/workflows/docker-build.yml

@@ -30,6 +30,7 @@ jobs:
   # Build platform matrix excludes. if-conditional with matrix on job level is not
   # supported, see https://github.com/actions/runner/issues/1985
   platform-excludes:
+    permissions: {}
     runs-on: ubuntu-latest
     outputs:
       excludes: ${{ steps.excludes.outputs.matrix }}

.github/workflows/pre-commit.yml

@@ -1,5 +1,8 @@
 name: pre-commit
 
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:

.github/workflows/pytest.yml

@@ -1,5 +1,8 @@
 name: Run Pytest on Pull Request
 
+permissions:
+  contents: read
+
 on:
   pull_request:
   push: