Tighten permissions

.github/workflows/ci.yml

@@ -16,6 +16,9 @@ env:
   PIP_NO_PYTHON_VERSION_WARNING: "1"
   PYTHON_LATEST: "3.10"
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: tox on ${{ matrix.python-version }}
@@ -125,7 +128,7 @@ jobs:
           python-version: "3.10"
 
       - run: python -m pip install --upgrade wheel tox
-      - run: tox -e docs
+      - run: python -m tox -e docs
 
   pyright:
     name: Check types using pyright
@@ -148,7 +151,7 @@ jobs:
           python-version: ${{env.PYTHON_LATEST}}
 
       - run: python -m pip install --upgrade wheel tox
-      - run: tox -e pyright
+      - run: python -m tox -e pyright
 
   package:
     name: Build & verify package