From 4b4da14880c19fd140388b7613fc914ca0734a7d Mon Sep 17 00:00:00 2001
From: Hynek Schlawack <hs@ox.cx>
Date: Thu, 29 Sep 2022 11:00:18 +0200
Subject: [PATCH] Tighten permissions

---
 .github/workflows/ci.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f466814e..2b858fa2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,9 @@ env:
   PIP_NO_PYTHON_VERSION_WARNING: "1"
   PYTHON_LATEST: "3.10"
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: tox on ${{ matrix.python-version }}
@@ -125,7 +128,7 @@ jobs:
           python-version: "3.10"
 
       - run: python -m pip install --upgrade wheel tox
-      - run: tox -e docs
+      - run: python -m tox -e docs
 
   pyright:
     name: Check types using pyright
@@ -148,7 +151,7 @@ jobs:
           python-version: ${{env.PYTHON_LATEST}}
 
       - run: python -m pip install --upgrade wheel tox
-      - run: tox -e pyright
+      - run: python -m tox -e pyright
 
   package:
     name: Build & verify package