ci(github-actions): add read permissions and use env vars in summary

Author: rtuszik

.github/workflows/build-and-push.yml

@@ -18,6 +18,10 @@ on:
         branches:
             - dev
 
+permissions:
+    contents: read
+    packages: write
+
 jobs:
     build-and-push:
         runs-on: ubuntu-latest

.github/workflows/full-test-jsonl.yml

@@ -13,6 +13,9 @@ on:
             - "pyproject.toml"
             - "uv.lock"
 
+permissions:
+    contents: read
+
 jobs:
     test-container-jsonl:
         runs-on: ubuntu-latest
@@ -101,5 +104,7 @@ jobs:
               run: |
                   echo "## Container Test Summary" >> $GITHUB_STEP_SUMMARY
                   echo "- **PR Number:** ${{ github.event.pull_request.number }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Photon Version:** ${{ env.PHOTON_VERSION }}" >> $GITHUB_STEP_SUMMARY
-                  echo "- **Status:** ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Photon Version:** ${PHOTON_VERSION}" >> $GITHUB_STEP_SUMMARY
+                  echo "- **Status:** ${JOB_STATUS}" >> $GITHUB_STEP_SUMMARY
+              env:
+                JOB_STATUS: ${{ job.status }}

.github/workflows/full-test.yml

@@ -14,6 +14,9 @@ on:
             - "pyproject.toml"
             - "uv.lock"
 
+permissions:
+    contents: read
+
 jobs:
     test-container:
         runs-on: ubuntu-latest