ci: added GitHub Actions permissions monitoring

Added the GitHubSecurityLab/actions-permissions/monitor action to advisor.yml, build.yml, and publish.yml files. This action will monitor permissions based on the provided config file.

.github/workflows/advisor.yml

@@ -0,0 +1,26 @@
+name: permissions advisor
+
+permissions:
+  actions: read
+
+on:
+  workflow_dispatch:
+    inputs:
+      name:
+        description: 'The name of the workflow file to analyze'
+        required: true
+        type: string
+      count:
+        description: 'How many last runs to analyze'
+        required: false
+        type: number
+        default: 10
+
+jobs:
+  advisor:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: GitHubSecurityLab/actions-permissions/[email protected]
+      with:
+        name: ${{ inputs.name }}
+        count: ${{ inputs.count }}

.github/workflows/black.yml

@@ -24,6 +24,9 @@ jobs:
       run:
         shell: bash
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/[email protected]
+        with:
+          config: ${{ vars.PERMISSIONS_CONFIG }}
       - uses: actions/[email protected]
       - name: setting up python ${{ matrix.python-version }}
         uses: actions/[email protected]

.github/workflows/build.yml

@@ -24,6 +24,9 @@ jobs:
         shell: bash
     name: python ${{ matrix.python-version }} on ${{ matrix.os }}
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/[email protected]
+        with:
+          config: ${{ vars.PERMISSIONS_CONFIG }}
       - uses: actions/[email protected]
       - name: setting up python ${{ matrix.python-version }}
         uses: actions/[email protected]

.github/workflows/publish.yml

@@ -20,6 +20,9 @@ jobs:
       run:
         shell: bash
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/[email protected]
+        with:
+          config: ${{ vars.PERMISSIONS_CONFIG }}
       - uses: actions/[email protected]
       - name: setting up python ${{ matrix.python-version }}
         uses: actions/[email protected]