CI: run on push to main and set least-privilege workflow permissions

.github/workflows/ci.yml

@@ -1,7 +1,13 @@
 name: CI
 on:
+  push:
+    branches:
+      - main
   pull_request:
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   CI:
     runs-on: ${{ matrix.os }}

.github/workflows/coverage.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: 0 0 * * *
 
+permissions:  # least privilege; jobs needing OIDC override this
+  contents: read
+
 jobs:
   Coverage:
     runs-on: ubuntu-latest

.github/workflows/spec_update.yml

@@ -4,6 +4,9 @@ on:
   repository_dispatch:
     types: [spec_update]
 
+permissions:  # least privilege; PR creation uses the SPEC_UPDATE_TOKEN PAT
+  contents: read
+
 jobs:
   Update:
     runs-on: ubuntu-latest