ci: Refactor invocation

.github/workflows/build.yml

@@ -2,17 +2,17 @@ name: Build, Lint, Test and possibly release
 
 on:
   push:
-    branches:
-      - "*"
+    branches: [ "main" ]
   pull_request:
-    branches:
-      - main
+    branches: [ "main" ]
   release:
-    types:
-    - published
+    types: [ "published" ]
   schedule:
     - cron: '0 0 * * 0'
 
+permissions:
+  contents: read
+
 jobs:
   build-lint-test-release:
     runs-on: ubuntu-latest