Refactor GitHub Actions workflows for improved readability and mainta…

…inability

.github/workflows/python.yml

@@ -1,10 +1,13 @@
 name: Python CI
 
+permissions:
+  contents: read
+
 on:
   push:
-    branches: ["master"]
+    branches: [master]
   pull_request:
-    branches: ["master"]
+    branches: [master]
 
 jobs:
   test:

.github/workflows/rust-clippy.yml

@@ -2,21 +2,21 @@ name: rust-clippy analyze
 
 on:
   push:
-    branches: ["master"]
+    branches: [master]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: ["master"]
+    branches: [master]
   schedule:
-    - cron: "39 12 * * 4"
+    - cron: 39 12 * * 4
+
+permissions: read-all
 
 jobs:
   rust-clippy-analyze:
     name: Run rust-clippy analyzing
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       security-events: write
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

.github/workflows/rust.yml

@@ -1,10 +1,12 @@
 name: Rust CI
 
+permissions: read-all
+
 on:
   push:
-    branches: ["master"]
+    branches: [master]
   pull_request:
-    branches: ["master"]
+    branches: [master]
 
 env:
   CARGO_TERM_COLOR: always
@@ -15,7 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Cache Cargo registry
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.cargo/registry
           key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}

.gitignore

@@ -32,5 +32,6 @@ secrets
 *.log
 **/gen/*.json
 .build-metrics.db
+.trunk
 # Temp Ignore