[jeremykubica]

This PR is a test of a pending change to the PPT: lincc-frameworks/python-project-template#607

The goal is to restrict the permissions in github workflows by starting with no permissions and only adding what is needed. It also performs other updates from the PPT, such as adding a development guide, upgrading the minimum python version, etc.

I want to merge this into citation-compass first to confirm it does not break anything.

[github-actions]

Before [fa58b04]	After [13054e0]	Ratio	Benchmark (Parameter)
25.0±0.1ns	46.3±9ns	1.85	benchmarks.time_call_function_untracked
139±0.3ns	146±0.3ns	1.06	benchmarks.time_call_function
224±4ns	232±0.4ns	1.03	benchmarks.time_instantiate_class
773±3ns	787±20ns	1.02	benchmarks.time_cite_module
2.64±0.05μs	2.62±0.04μs	0.99	benchmarks.time_create_function

Click here to view all benchmarks.

[Copilot]

🟡 Changes recommended

Duplicate permission mappings invalidate two workflows, while unrelated changes remove PR coverage reporting and Python 3.8–3.9 support.

4 open findings

• Duplicate permissions mapping drops required artifact access · New
• Duplicate permissions mapping invalidates publishing workflow · New
• Disabling PR Codecov uploads removes coverage reporting · New
• Metadata change unexpectedly drops Python 3.8 and 3.9 support · New

What changed in this PR

Synchronizes citation-compass with the pending Python Project Template permission-hardening changes.

Changes:

• Applies least-privilege GitHub Actions permissions.
• Disables persisted checkout credentials.
• Updates template metadata, tooling configuration, and contributor guidance.

File	Description
pyproject.toml	Updates Python and tooling configuration.
DEVELOPMENT_GUIDE.md	Adds contributor guidance.
AGENTS.md	Directs agents to the development guide.
.github/​workflows/​testing-and-coverage.yml	Restricts test workflow permissions.
.github/​workflows/​smoke-test.yml	Restricts smoke-test permissions.
.github/​workflows/​publish-to-pypi.yml	Revises publishing permissions.
.github/​workflows/​publish-benchmarks-pr.yml	Revises benchmark-comment permissions.
.github/​workflows/​pre-commit-ci.yml	Restricts pre-commit permissions.
.github/​workflows/​build-documentation.yml	Restricts documentation-build permissions.
.github/​workflows/​asv-pr.yml	Restricts PR benchmark permissions.
.github/​workflows/​asv-nightly.yml	Restricts nightly benchmark permissions.
.github/​workflows/​asv-main.yml	Hardens benchmark deployment checkout.
.copier-answers.yml	Records the updated template revision.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.61%. Comparing base (242cb4f) to head (2ecc270).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #55   +/-   ##
=======================================
  Coverage   93.61%   93.61%           
=======================================
  Files           5        5           
  Lines         282      282           
=======================================
  Hits          264      264           
  Misses         18       18           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🔵 Needs a closer look

It includes an unrelated breaking Python requirement change and grants an unnecessary repository-content permission.

0 open findings

4 resolved since last review

• Duplicate permissions mapping invalidates publishing workflow
• Duplicate permissions mapping drops required artifact access
• Metadata change unexpectedly drops Python 3.8 and 3.9 support
• Disabling PR Codecov uploads removes coverage reporting

Previously missed (1)

In code that hasn't changed since last review

Remove unnecessary contents read permission

.github/​workflows/​publish-benchmarks-pr.yml:22

Remove this permission to preserve the stated least-privilege goal. This job never checks out repository contents, and the artifact downloader documents actions: read—not contents: read—as the permission required to download an artifact from a private repository.

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The unrelated Python 3.8/3.9 support drop remains an unresolved breaking metadata change.

0 open findings

🧠 Review effort: Balanced

[drewoldag]

I was unaware that these permissions settings were available options for github actions. This is really neat.