ci: improvements

[calebdoxsey]

Summary

Some improvements for CI:

1. Fix the doc generation so that pre-commit doesn't complain about newly generated docs

...

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review

To fix this problem, we should add a permissions block to the workflow file. The safest and simplest way is to apply the permissions block at the workflow root, which sets the minimal permissions for all jobs unless overridden per job. Since none of the jobs require write access to repository contents or other resources, the recommended minimal permissions are contents: read. This restricts GITHUB_TOKEN to only read repository contents, which suffices for actions like actions/checkout and is inline with least privilege. The change should be made right after the name: and on: blocks, before the jobs: block. No further changes, methods, or imports are needed beyond this YAML addition.

To fix the issue, add a permissions block to the workflow file to explicitly restrict the GITHUB_TOKEN. The minimal secure default is permissions: contents: read either at the workflow root (applies to all jobs unless overridden) or for each job as needed. Since none of these jobs appear to need write permissions (they only check out code, build, lint, and run tests), setting the root-level permissions is sufficient and robust. The change should be made at the top level, after the name: and before on:, to ensure all jobs inherit the least privilege possible.

No method changes or additional imports are required—just the addition of a new YAML key.

---

The best way to fix the problem is to explicitly add a permissions block to restrict the default permissions of the GITHUB_TOKEN for the affected job(s). In this case, we should add permissions: { contents: read } to the pre-commit job in the reusable-build.yaml workflow (directly beneath the name / runs-on keys for that job). This ensures the job only has read access to repository contents, which is sufficient for checkout and running pre-commit checks. No code needs to be changed elsewhere and functionality will not be affected since none of the steps write to the repository or require elevated privileges.

---

To fix the problem, add an explicit permissions block at the root of the workflow YAML file. Specify contents: read as the minimal required permission for these jobs, since none of them appear to need write access or elevated privileges. This change should be made at the top level of .github/workflows/reusable-build.yaml, ideally just after the name: and before the on: block, to set the default for all jobs. No changes to existing functionality or step logic are needed, and no imports or external references are required.

---