YAML fixes, restrict GH Actions perms (#1349)

* Yaml: Remove redundant quotes
* GitHub Actions: Set top-level permissions to read-all

.github/actions/pnpm-node-install/action.yaml

@@ -1,18 +1,18 @@
-name: 'Install Node, pnpm and dependencies.'
-description: 'Install Node, pnpm and dependencies using cache.'
+name: Install Node, pnpm and dependencies.
+description: Install Node, pnpm and dependencies using cache.
 
 inputs:
   node-version:
-    description: 'Node.js version'
+    description: Node.js version
     required: true
   pnpm-version:
-    description: 'pnpm version'
+    description: pnpm version
     required: true
   pnpm-install-args:
-    description: 'Extra arguments for pnpm install, e.g. --no-frozen-lockfile.'
+    description: Extra arguments for pnpm install, e.g. --no-frozen-lockfile.
 
 runs:
-  using: 'composite'
+  using: composite
   steps:
     - uses: pnpm/action-setup@v4
       with:
@@ -21,7 +21,7 @@ runs:
       uses: actions/setup-node@v4
       with:
         node-version: ${{ inputs.node-version }}
-        cache: 'pnpm'
+        cache: pnpm
     - name: Install JS dependencies
       run: pnpm install ${{ inputs.pnpm-install-args }}
       shell: bash

.github/actions/poetry-python-install/action.yaml

@@ -1,23 +1,23 @@
-name: 'Install Python, poetry and dependencies.'
-description: 'Install Python, Poetry and poetry dependencies using cache'
+name: Install Python, poetry and dependencies.
+description: Install Python, Poetry and poetry dependencies using cache
 
 inputs:
   python-version:
-    description: 'Python version'
+    description: Python version
     required: true
   poetry-version:
-    description: 'Poetry version'
+    description: Poetry version
     required: true
   poetry-working-directory:
-    description: 'Working directory for poetry command.'
+    description: Working directory for poetry command.
     required: false
-    default: '.'
+    default: .
   poetry-install-args:
-    description: 'Extra arguments for poetry install, e.g. --with tests.'
+    description: Extra arguments for poetry install, e.g. --with tests.
     required: false
 
 runs:
-  using: 'composite'
+  using: composite
   steps:
     - name: Cache poetry install
       uses: actions/cache@v4

.github/workflows/ci.yaml

@@ -8,6 +8,8 @@ on:
   push:
     branches: [main, dev]
 
+permissions: read-all
+
 jobs:
   pytest:
     uses: ./.github/workflows/pytest.yaml
@@ -23,5 +25,5 @@ jobs:
     name: Run CI
     needs: [mypy, pytest, e2e-tests]
     steps:
-      - name: 'Done'
+      - name: Done
         run: echo "Done"

.github/workflows/e2e-tests.yaml

@@ -2,6 +2,8 @@ name: E2ETests
 
 on: [workflow_call]
 
+permissions: read-all
+
 jobs:
   ci:
     runs-on: ${{ matrix.os }}

.github/workflows/mypy.yaml

@@ -2,6 +2,8 @@ name: Mypy
 
 on: [workflow_call]
 
+permissions: read-all
+
 jobs:
   mypy:
     runs-on: ubuntu-latest

.github/workflows/publish.yaml

@@ -5,6 +5,8 @@ on:
   release:
     types: [published]
 
+permissions: read-all
+
 jobs:
   ci:
     uses: ./.github/workflows/ci.yaml

.github/workflows/pytest.yaml

@@ -2,6 +2,8 @@ name: Pytest
 
 on: [workflow_call]
 
+permissions: read-all
+
 jobs:
   pytest:
     runs-on: ubuntu-latest

pnpm-workspace.yaml

@@ -1,5 +1,5 @@
 packages:
-  - 'frontend/'
-  - 'libs/react-components/'
-  - 'libs/react-client/'
-  - 'libs/copilot/'
+  - frontend/
+  - libs/react-components/
+  - libs/react-client/
+  - libs/copilot/