Coverage calculation for this build was skipped because it contains the same data as another build. See this build for the coverage details.
If you feel that something is wrong here, please contact support.

Set explicit GITHUB_TOKEN permissions in workflows

CodeQL flagged all three workflows for leaving the GITHUB_TOKEN at the
repository default, which currently grants write access across contents,
issues, pull requests and more. Each workflow now declares contents: read
at the top level, with the jobs that need more widening it themselves.

The build jobs keep statuses: write because goveralls hands the token to
coveralls, which posts the coverage status back to the commit. The CodeQL
analyze job keeps security-events: write to upload its results and
actions: read to inspect the workflow run.