Improve GitHub CI workflow

Bring GitHub CI workflow in line with Cookiecutter plugin template.

.github/workflows/main.yml

@@ -5,16 +5,19 @@ on: [push, pull_request]
 env:
   PYTEST_ADDOPTS: "--color=yes"
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    name: Test - ${{ matrix.python-version }}
+    name: Test - Python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.8", "3.9", "3.10", "3.11"]
+        python-version: ["3.8", "3.9", "3.10", "3.11", "3.12"]
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           persist-credentials: false
       - name: Install uv
@@ -34,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           persist-credentials: false
 
@@ -48,12 +51,12 @@ jobs:
 
       - name: Install dependencies
         env:
-          UV_PYTHON: "python3.9"
+          UV_PYTHON: "python3.10"
         run: |
           uv sync --frozen --no-sources
 
       - name: Run linters
-        run: uv run invoke lint --diff
+        run: pdm run invoke lint --diff
 
   deploy:
     name: Deploy
@@ -67,10 +70,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v3
-        with:
-          token: ${{ secrets.GH_TOKEN }}
-          persist-credentials: false
+      - uses: actions/checkout@v4
 
       - name: Install uv
         uses: astral-sh/setup-uv@v3
@@ -83,7 +83,7 @@ jobs:
       - name: Publish
         if: ${{ steps.check_release.outputs.autopub_release=='true' }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           uvx --with 'autopub[github]' autopub prepare
           uvx --with 'autopub[github]' autopub commit