fix: reduce token permissions (#7721)

* fix: reduce token permissions

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix: reduce token permissions

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

* fix

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

---------

Signed-off-by: Charles-Edouard Brétéché <charles.edouard@nirmata.com>

.github/workflows/check-actions.yaml

@@ -1,5 +1,7 @@
 name: Check actions
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -9,8 +11,6 @@ on:
       - 'main'
       - 'release*'
 
-permissions: {}
-
 jobs:
   check:
     runs-on: ubuntu-latest

.github/workflows/cli.yaml

@@ -1,5 +1,7 @@
 name: cli
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -10,8 +12,6 @@ on:
       - 'main'
       - 'release*'
 
-permissions: {}
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/codecov.yaml

@@ -1,5 +1,7 @@
 name: Codecov
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -9,8 +11,6 @@ on:
       - 'main'
       - 'release*'
 
-permissions: {}
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/comment-commands.yaml

@@ -1,13 +1,13 @@
 name: Issue and PR comment commands
 
+permissions: {}
+
 on:
   issue_comment:
     types: 
       - created
       - edited
 
-permissions: {}
-
 jobs:
   execute:
     runs-on: ubuntu-latest

.github/workflows/conformance.yaml

@@ -1,13 +1,13 @@
 name: Conformance tests
 
+permissions: {}
+
 on:
   pull_request:
     branches:
       - 'main'
       - 'release*'
 
-permissions: {}
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -15,8 +15,6 @@ concurrency:
 jobs:
   prepare-images:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
@@ -37,8 +35,6 @@ jobs:
   # runs conformance test suites with configuration:
   standard:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -110,8 +106,6 @@ jobs:
   # runs conformance test suites with configuration:
   force-failure-policy-ignore:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -168,8 +162,6 @@ jobs:
   # runs conformance test suites with configuration:
   default:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -224,8 +216,6 @@ jobs:
   # runs conformance test suites with configuration:
   policy-library:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     strategy:
       fail-fast: false
       matrix:

.github/workflows/fossa.yml

@@ -1,12 +1,12 @@
 name: FOSSA
 
+permissions: {}
+
 on:
   push:
     branches: 
       - main
 
-permissions: {}
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -14,8 +14,6 @@ concurrency:
 jobs:
   fossa-scan:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

.github/workflows/helm-release.yaml

@@ -1,5 +1,7 @@
 name: helm-release
 
+permissions: {}
+
 on:
   push:
     tags:

.github/workflows/helm-test.yaml

@@ -1,5 +1,7 @@
 name: helm-test
 
+permissions: {}
+
 on:
   pull_request:
     branches:
@@ -9,8 +11,6 @@ on:
       - charts/**
       - .github/workflows/helm-test.yaml
 
-permissions: {}
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/images-build.yaml

@@ -1,5 +1,7 @@
 name: Build images
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -9,13 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   build-images:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3

.github/workflows/images-publish.yaml

@@ -1,5 +1,7 @@
 name: Publish images
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -10,13 +12,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   publish-images:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       packages: write
       id-token: write 
     outputs:

.github/workflows/lint.yaml

@@ -1,5 +1,7 @@
 name: Lint
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -13,9 +15,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   tests:
     runs-on: ubuntu-latest

.github/workflows/nancy.yaml

@@ -1,5 +1,7 @@
 name: Nancy
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -13,9 +15,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   nancy:
     runs-on: ubuntu-latest

.github/workflows/pr-update.yaml

@@ -1,17 +1,15 @@
 name: PR update
 
+permissions: {}
+
 on:
   push:
     branches:
       - 'main'
       - 'release-*'
 
-permissions: {}
-
 jobs:
   autoupdate:
-    permissions:
-      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/release.yaml

@@ -9,7 +9,6 @@ jobs:
   release-images:
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       packages: write
       id-token: write
     outputs:

.github/workflows/report-on-vulnerabilities.yaml

@@ -1,12 +1,12 @@
 name: report-on-vulnerabilities
 
+permissions: {}
+
 on:
   workflow_dispatch: {}
   schedule:
     - cron: '23 2 * * *' # Every day at 02:23
 
-permissions: {}
-
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
@@ -14,8 +14,6 @@ env:
 jobs:
   scan:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
     outputs:
       results: ${{ steps.parse-results.outputs.results }}
     steps:
@@ -55,7 +53,6 @@ jobs:
     if: needs.scan.outputs.results == 'found'
     needs: scan
     permissions:
-      contents: read
       issues: write
     steps:
       - name: Checkout

.github/workflows/scorecard.yaml

@@ -1,5 +1,7 @@
 name: Scorecards supply-chain security
 
+permissions: {}
+
 on:
   schedule:
     - cron: '30 1 * * 6'
@@ -7,8 +9,6 @@ on:
     branches:
       - main
 
-permissions: read-all
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/sonarcloud.yaml

@@ -1,5 +1,7 @@
 name: Sonarcloud workflow
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -10,9 +12,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   sonarcloud:
     runs-on: ubuntu-latest

.github/workflows/tests.yaml

@@ -1,5 +1,7 @@
 name: Tests
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -13,9 +15,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   tests:
     runs-on: ubuntu-latest

.github/workflows/verify-codegen.yaml

@@ -1,5 +1,7 @@
 name: Verify codegen
 
+permissions: {}
+
 on:
   push:
     branches:
@@ -13,9 +15,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   verify-codegen:
     runs-on: ubuntu-latest