Merge pull request #51 from hartwork/improve-ci

Improve CI

.github/workflows/codespell.yml

@@ -24,6 +24,7 @@ on:
     - cron: '0 2 * * 5'  # Every Friday at 2am
   workflow_dispatch:
 
+# Drop permissions to minimum, for security
 permissions:
   contents: read
 

.github/workflows/pre-commit-detect-outdated.yml

@@ -20,6 +20,7 @@ name: Detect outdated pre-commit hooks
 on:
   schedule:
     - cron: '0 16 * * 5'  # Every Friday 4pm
+  workflow_dispatch:
 
 # NOTE: This will drop all permissions from GITHUB_TOKEN except metadata read,
 #       and then (re)add the ones listed below:

.github/workflows/pre-commit.yml

@@ -17,9 +17,16 @@
 
 name: Run pre-commit
 
+# Drop permissions to minimum, for security
+permissions:
+  contents: read
+
 on:
-- pull_request
-- push
+  pull_request:
+  push:
+  schedule:
+    - cron: '0 3 * * 5'  # Every Friday at 3am
+  workflow_dispatch:
 
 jobs:
   pre-commit:

.github/workflows/run-tests.yml

@@ -17,9 +17,16 @@
 
 name: Run the test suite
 
+# Drop permissions to minimum, for security
+permissions:
+  contents: read
+
 on:
-- pull_request
-- push
+  pull_request:
+  push:
+  schedule:
+    - cron: '0 3 * * 5'  # Every Friday at 3am
+  workflow_dispatch:
 
 jobs:
   run-tests: