From a26d9860561e1a32602afe917b011a76bbccb15f Mon Sep 17 00:00:00 2001
From: Lukas Geiger <lukas@um-bruch.org>
Date: Fri, 16 Oct 2026 01:37:27 +0200
Subject: [PATCH] ci: cover native macOS and bound test job permissions

Add macOS to the existing Python 3.11/3.12 matrix, restrict the token to contents read, and bound test jobs to 15 minutes. Keep all source tests and the Linux Pyright gate unchanged.

Generated-with: gpt-6.1-sol (Codex)
---
 .github/workflows/tests.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 6b97b6e..4e66609 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,13 +6,17 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   pytest:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest]
         python-version: ["3.11", "3.12"]
     env:
       QT_QPA_PLATFORM: offscreen