Clean up CI (#4553)

* 💚 overwork cppcheck

* 🔒 adjust permissions

* 💚 fixes

* 💚 fixes

.github/workflows/ubuntu.yml

@@ -8,7 +8,10 @@ on:
       - release/*
   pull_request:
   workflow_dispatch:
-  
+
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
@@ -46,7 +49,6 @@ jobs:
     strategy:
       matrix:
         target: [
-          ci_cppcheck,          # needs cppcheck
           ci_test_valgrind,     # needs Valgrind
           ci_test_amalgamation, # needs AStyle
           ci_infer,             # needs Infer
@@ -75,7 +77,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        target: [ci_cpplint, ci_reproducible_tests, ci_non_git_tests, ci_offline_testdata]
+        target: [ci_cppcheck, ci_cpplint, ci_reproducible_tests, ci_non_git_tests, ci_offline_testdata, ci_reuse_compliance]
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
@@ -126,9 +128,6 @@ jobs:
 
   ci_test_coverage:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      checks: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
@@ -266,23 +265,6 @@ jobs:
           . /opt/intel/oneapi/setvars.sh
           cmake --build build --target ci_icpc
 
-  ci_reuse_compliance:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
-        with:
-          egress-policy: audit
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
-        with:
-          python-version: '3.11'
-      - name: Install REUSE tool
-        run:  python -m pip install -r .reuse/requirements.txt
-      - name: Run REUSE lint
-        run: reuse lint
-
   ci_test_documentation:
     runs-on: ubuntu-latest
     strategy:

.github/workflows/windows.yml

@@ -9,6 +9,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true