[ci] Update action versions, add permissions and dependebot, speed up examples (#290)

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    groups:
+      # Batch all action bumps into a single PR to keep the noise down.
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "[ci]"

.github/workflows/binder.yml

@@ -4,6 +4,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   Create-MyBinderOrg-Cache:
     runs-on: ubuntu-latest

.github/workflows/docs.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - develop
 
+permissions:
+  contents: write  # pushes the rendered docs to the documentation branch
+
 jobs:
   docs:
     runs-on: ubuntu-latest

.github/workflows/examples.yml

@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: '0 4 1 * *'
 
+permissions:
+  contents: read
+
 jobs:
   examples:
     runs-on: ${{ matrix.os }}
@@ -30,14 +33,20 @@ jobs:
       - name: uv
         uses: astral-sh/setup-uv@v5
 
-      - name: Install
+      - name: Install LaTeX
         run: |
           sudo apt-get update
-          sudo apt-get install dvipng texlive-latex-extra texlive-fonts-recommended cm-super
+          sudo apt-get install -y --no-install-recommends \
+            dvipng texlive-latex-extra texlive-fonts-recommended cm-super
+
+      - name: Install
+        run: |
           uv pip install wheel --system
           uv pip install . --system
-          uv pip install pytest nbmake --system
+          uv pip install pytest pytest-xdist nbmake --system
           uv pip install -U matplotlib!=3.7.0 --system # Exclude version 3.7.0 of matplotlib as this breaks local imports of style files.
 
+      # The notebooks are independent (only 07 writes to disk), so execute them in
+      # parallel instead of serially.
       - name: Run tests
-        run: pytest -vv --nbmake examples/*.ipynb
+        run: pytest -vv -n auto --nbmake examples/*.ipynb

.github/workflows/pytest.yml

@@ -10,6 +10,9 @@ on:
   schedule:
     - cron: '0 4 * * 0'
 
+permissions:
+  contents: read
+
 jobs:
   pytest:
     runs-on: ${{ matrix.os }}

.github/workflows/release.yml

@@ -5,10 +5,15 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build sdist and wheel
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@v6
       name: Checkout repository

.github/workflows/ruff.yml

@@ -5,6 +5,10 @@ on:
       - master
       - develop
   pull_request:
+
+permissions:
+  contents: read
+
 jobs:
   ruff:
     runs-on: ubuntu-latest