From 22d2daba3004dd0bd25fbc14c12f36a9a96c09bd Mon Sep 17 00:00:00 2001
From: Fabian Joswig <fjosw@users.noreply.github.com>
Date: Mon, 27 Jul 2026 22:17:19 +0200
Subject: [PATCH] [ci] Update action versions, add permissions and dependebot,
 speed up examples (#290)

---
 .github/dependabot.yml         | 14 ++++++++++++++
 .github/workflows/binder.yml   |  3 +++
 .github/workflows/docs.yml     |  3 +++
 .github/workflows/examples.yml | 17 +++++++++++++----
 .github/workflows/pytest.yml   |  3 +++
 .github/workflows/release.yml  |  5 +++++
 .github/workflows/ruff.yml     |  4 ++++
 7 files changed, 45 insertions(+), 4 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..ecb28aa4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      # Batch all action bumps into a single PR to keep the noise down.
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "[ci]"
diff --git a/.github/workflows/binder.yml b/.github/workflows/binder.yml
index 7b0e7884..c30dfb39 100644
--- a/.github/workflows/binder.yml
+++ b/.github/workflows/binder.yml
@@ -4,6 +4,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   Create-MyBinderOrg-Cache:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 9f33083b..3e182593 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - develop
 
+permissions:
+  contents: write  # pushes the rendered docs to the documentation branch
+
 jobs:
   docs:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/examples.yml b/.github/workflows/examples.yml
index 66fe4385..8f481bc7 100644
--- a/.github/workflows/examples.yml
+++ b/.github/workflows/examples.yml
@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: '0 4 1 * *'
 
+permissions:
+  contents: read
+
 jobs:
   examples:
     runs-on: ${{ matrix.os }}
@@ -30,14 +33,20 @@ jobs:
       - name: uv
         uses: astral-sh/setup-uv@v5
 
-      - name: Install
+      - name: Install LaTeX
         run: |
           sudo apt-get update
-          sudo apt-get install dvipng texlive-latex-extra texlive-fonts-recommended cm-super
+          sudo apt-get install -y --no-install-recommends \
+            dvipng texlive-latex-extra texlive-fonts-recommended cm-super
+
+      - name: Install
+        run: |
           uv pip install wheel --system
           uv pip install . --system
-          uv pip install pytest nbmake --system
+          uv pip install pytest pytest-xdist nbmake --system
           uv pip install -U matplotlib!=3.7.0 --system # Exclude version 3.7.0 of matplotlib as this breaks local imports of style files.
 
+      # The notebooks are independent (only 07 writes to disk), so execute them in
+      # parallel instead of serially.
       - name: Run tests
-        run: pytest -vv --nbmake examples/*.ipynb
+        run: pytest -vv -n auto --nbmake examples/*.ipynb
diff --git a/.github/workflows/pytest.yml b/.github/workflows/pytest.yml
index 86a05519..69e449ab 100644
--- a/.github/workflows/pytest.yml
+++ b/.github/workflows/pytest.yml
@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: '0 4 * * 0'
 
+permissions:
+  contents: read
+
 jobs:
   pytest:
     runs-on: ${{ matrix.os }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8be1ad74..abe6def5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,10 +5,15 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build sdist and wheel
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
       name: Checkout repository
diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml
index e747bb2b..f864a6cf 100644
--- a/.github/workflows/ruff.yml
+++ b/.github/workflows/ruff.yml
@@ -5,6 +5,10 @@ on:
       - master
       - develop
   pull_request:
+
+permissions:
+  contents: read
+
 jobs:
   ruff:
     runs-on: ubuntu-latest