Minor GHA updates

.github/release-drafter.yml

@@ -1,3 +1,6 @@
+name-template: 'Draft: v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+change-template: '- $TITLE (#$NUMBER) @$AUTHOR'
 categories:
   - title: 'Breaking Changes'
     labels:
@@ -21,6 +24,26 @@ categories:
       - 'dependencies'
       - 'chore'
       - 'github_actions'
+version-resolver:
+  major:
+    labels:
+      - 'breaking'
+  minor:
+    labels:
+      - 'feature'
+      - 'enhancement'
+      - 'new computation'
+  patch:
+    labels:
+      - 'fix'
+      - 'bug'
+      - 'bugfix'
+      - 'refactor'
+      - 'documentation'
+      - 'dependencies'
+      - 'chore'
+      - 'github_actions'
+  default: patch
 template: |
   # What's Changed
 

.github/workflows/ci-python.yml

@@ -1,4 +1,6 @@
 name: Python checks
+permissions:
+  contents: read
 
 on:
   push:

.github/workflows/codecov.yml

@@ -22,6 +22,8 @@ jobs:
   run:
     name: Codecov
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v5
       with:

.github/workflows/publish_to_pypi.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   deploy:
     name: Build and upload wheels
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
 

.github/workflows/release_drafter.yml

@@ -6,6 +6,8 @@ on:
 
 jobs:
   update_release_draft:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
       - name: Release Drafter