Merge pull request #48103 from ruthra-kumar/restrictive_github_actions

ci: restrictive permission for GH actions

.github/workflows/backport.yml

@@ -5,6 +5,9 @@ on:
       - closed
       - labeled
 
+permissions:
+  contents: read
+
 jobs:
   main:
     runs-on: ubuntu-latest

.github/workflows/docker-release.yml

@@ -2,6 +2,10 @@ name: Trigger Docker build on release
 on:
   release:
     types: [released]
+
+permissions:
+  contents: read
+
 jobs:
   curl:
     runs-on: ubuntu-latest

.github/workflows/docs-checker.yml

@@ -3,6 +3,9 @@ on:
   pull_request:
     types: [ opened, synchronize, reopened, edited ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/initiate_release.yml

@@ -2,6 +2,10 @@
 # To add/remove versions just modify the matrix.
 
 name: Create weekly release pull requests
+
+permissions:
+  contents: read
+
 on:
   schedule:
     # 9:30 UTC => 3 PM IST Tuesday

.github/workflows/labeller.yml

@@ -3,6 +3,10 @@ on:
   pull_request_target:
     types: [opened, reopened]
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   triage:
     runs-on: ubuntu-latest

.github/workflows/linters.yml

@@ -3,6 +3,9 @@ name: Linters
 on:
   pull_request: { }
 
+permissions:
+  contents: read
+
 jobs:
 
   linters:

.github/workflows/patch.yml

@@ -10,6 +10,9 @@ on:
       - '**.csv'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: patch-develop-${{ github.event_name }}-${{ github.event.number || github.event_name == 'workflow_dispatch' && github.run_id || '' }}
   cancel-in-progress: true

.github/workflows/release.yml

@@ -3,6 +3,10 @@ on:
   push:
     branches:
       - version-13
+
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release

.github/workflows/run-indinvidual-tests.yml

@@ -7,6 +7,9 @@ concurrency:
   group: server-individual-tests-develop-${{ github.event_name }}-${{ github.event.number || github.event_name == 'workflow_dispatch' && github.run_id || '' }}
   cancel-in-progress: false
 
+permissions:
+  contents: read
+
 jobs:
   discover:
     runs-on: ubuntu-latest

.github/workflows/server-tests-mariadb-faux.yml

@@ -10,6 +10,9 @@ on:
       - "**.md"
       - "**.html"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

.github/workflows/server-tests-mariadb.yml

@@ -25,6 +25,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 concurrency:
   group: server-mariadb-develop-${{ github.event_name }}-${{ github.event.number || github.event_name == 'workflow_dispatch' && github.run_id || '' }}
   cancel-in-progress: true

.github/workflows/server-tests-postgres.yml

@@ -12,6 +12,9 @@ concurrency:
   group: server-postgres-develop-${{ github.event_name }}-${{ github.event.number || github.event_name == 'workflow_dispatch' && github.run_id || '' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test:
     if: ${{ contains(github.event.pull_request.labels.*.name, 'postgres') }}