Merge pull request #10471 from shubham-pampattiwar/ci/workflow-token-permissions

Set least-privilege GITHUB_TOKEN permissions in workflows

.github/workflows/get-go-version.yaml

@@ -10,6 +10,9 @@ on:
         description: "The expected Go version"
         value: ${{ jobs.extract.outputs.version }}
 
+permissions:
+  contents: read
+
 jobs:
   extract:
       runs-on: ubuntu-latest

.github/workflows/nightly-trivy-scan.yml

@@ -3,6 +3,9 @@ on:
   schedule:
     - cron: '0 2 * * *' # run at 2 AM UTC
 
+permissions:
+  contents: read
+
 jobs:
   nightly-scan:
     name: Trivy nightly scan
@@ -15,6 +18,7 @@ jobs:
         # list of images that need scan
         images: [velero, velero-plugin-for-aws, velero-plugin-for-gcp, velero-plugin-for-microsoft-azure]
     permissions:
+      contents: read  # for actions/checkout to fetch code
       security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
 
     steps:

.github/workflows/pr-ci-check.yml

@@ -1,5 +1,9 @@
 name: Pull Request CI Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   get-go-version:
     uses: ./.github/workflows/get-go-version.yaml

.github/workflows/pr-codespell.yml

@@ -1,5 +1,9 @@
 name: Pull Request Codespell Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
 
   codespell:

.github/workflows/pr-containers.yml

@@ -9,6 +9,9 @@ on:
       - 'Dockerfile'
       - 'Dockerfile-Windows'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

.github/workflows/pr-filepath-check.yml

@@ -1,5 +1,9 @@
 name: Pull Request File Path Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
 
   filepath-check:

.github/workflows/pr-goreleaser.yml

@@ -9,6 +9,9 @@ on:
       - '.goreleaser.yml'
       - 'hack/release-tools/goreleaser.sh'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

.github/workflows/pr-linter-check.yml

@@ -6,6 +6,10 @@ on:
       - "site/**"
       - "design/**"
       - "**/*.md"
+
+permissions:
+  contents: read
+
 jobs:
   get-go-version:
     uses: ./.github/workflows/get-go-version.yaml

.github/workflows/push-builder.yml

@@ -6,6 +6,9 @@ on:
     paths:
     - 'hack/build-image/Dockerfile'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build

.github/workflows/stale-issues.yml

@@ -3,6 +3,11 @@ on:
   schedule:
     - cron: "30 1 * * *" # Every day at 1:30 UTC
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     if: github.repository == 'velero-io/velero'