Permissions: simplify to workflow-level only; remove .gitignore canary marker

Author: mtfishman

.github/workflows/CheckCompatBounds.yml

@@ -1,6 +1,8 @@
 name: "Check Compat Bounds"
 on:
   pull_request: ~
+permissions:
+  contents: "read"
 jobs:
   check-compat-bounds:
     name: "Check Compat Bounds"

.github/workflows/Documentation.yml

@@ -11,12 +11,10 @@ concurrency:
   group: "${{ github.workflow }}-${{ github.ref }}"
   cancel-in-progress: "${{ github.ref_name != github.event.repository.default_branch || github.ref != 'refs/tags/v*' }}"
 permissions:
-  contents: read
+  contents: "write"
 jobs:
   build-and-deploy-docs:
     name: "Documentation"
-    permissions:
-      contents: write
     uses: "ITensor/ITensorActions/.github/workflows/Documentation.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

.github/workflows/FormatCheck.yml

@@ -6,6 +6,8 @@ on:
       - "synchronize"
       - "reopened"
       - "ready_for_review"
+permissions:
+  contents: "read"
 jobs:
   format-check:
     name: "Format Check"

.github/workflows/IntegrationTest.yml

@@ -12,13 +12,11 @@ on:
       - "ready_for_review"
       - "converted_to_draft"
 permissions:
-  contents: read
+  actions: "read"
+  contents: "read"
 jobs:
   integration-test:
     name: "IntegrationTest"
-    permissions:
-      actions: read
-      contents: read
     uses: "ITensor/ITensorActions/.github/workflows/IntegrationTest.yml@v1"
     secrets: "inherit"
     with:

.github/workflows/TagBot.yml

@@ -6,6 +6,9 @@ on:
   workflow_dispatch: ~
 env:
   REGISTRY_TAGBOT_ACTION: "JuliaRegistries/TagBot"
+permissions:
+  contents: "write"
+  issues: "read"
 jobs:
   TagBot:
     if: "github.event_name == 'workflow_dispatch' || github.actor == 'JuliaTagBot'"

.github/workflows/Tests.yml

@@ -19,6 +19,8 @@ on:
 concurrency:
   group: "${{ github.workflow }}-${{ github.ref }}"
   cancel-in-progress: "${{ startsWith(github.ref, 'refs/pull/') }}"
+permissions:
+  contents: "read"
 jobs:
   tests:
     name: "Tests"

.github/workflows/VersionCheck.yml

@@ -2,13 +2,11 @@ name: "Version Check"
 on:
   pull_request: ~
 permissions:
-  contents: read
+  contents: "read"
+  pull-requests: "read"
 jobs:
   version-check:
     name: "Version Check"
-    permissions:
-      contents: read
-      pull-requests: read
     uses: "ITensor/ITensorActions/.github/workflows/VersionCheck.yml@v1"
     with:
       localregistry: "https://github.com/ITensor/ITensorRegistry.git"

.gitignore

@@ -1,4 +1,3 @@
-# Permissions-hardening canary marker — remove before merging.
 *.cov
 *.mem
 *.o