ci: reduce API burden and stop using a PAT in trusted workflows

Author: consideRatio

.github/workflows/tests.yaml

@@ -8,6 +8,16 @@ on:
       - "v*"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
+concurrency:
+  # To reduce rate limitation issues, avoid running multiple workflows in
+  # paralell for the same git ref (PR / branch / tag) at the same time by
+  # discarding older in-progress runs in favor of the newest.
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pre-commit:
     runs-on: ubuntu-24.04
@@ -35,16 +45,16 @@ jobs:
   tests:
     runs-on: ubuntu-24.04
     env:
-      # Use TOKEN_READONLY if available (pushed branches), otherwise use GITHUB_TOKEN (PRs)
-      # TOKEN_READONLY is a PAT for @choldgraf that only has read-access to this repo but isn't available in PRs.
-      GITHUB_ACCESS_TOKEN: "${{ secrets.TOKEN_READONLY || github.token }}"
+      GITHUB_ACCESS_TOKEN: "${{ github.token }}"
     strategy:
+      # max-parallel declared to reduce rate limitation issues
+      max-parallel: 1
       matrix:
         include:
           # Only test oldest supported and latest python version to reduce
           # GitHub API calls, as they can get rate limited
-          - python-version: "3.10"
           - python-version: 3.x
+          - python-version: "3.10"
 
     steps:
       - uses: actions/checkout@v6