ci: Improved security on workflows. (#903)

.github/labeler.yml

@@ -25,7 +25,7 @@ packaging:
 - '**Dockerfile'
 submodules:
 - '**.gitmodules'
-github_action:
+github_actions:
 - '**/.github/labeler.yml'
 - '**/.github/dependabot.yml'
 - '**/.github/workflows/**'

.github/workflows/ci.yml

@@ -21,9 +21,13 @@ on:
       - '**ci.yml'
       - '**CMakeLists.txt'
 
+permissions:
+  contents: read
 
 jobs:
   linux-with-unit-test:
+    permissions:
+      contents: write
     concurrency: 
       group: linux-build-unit-test
       cancel-in-progress: false
@@ -66,6 +70,8 @@ jobs:
           TEST_EVENT_ID: ${{secrets.TEST_EVENT_ID}}
 
   linux-no-unit-tests:
+    permissions:
+      contents: write
     name: Linux ${{matrix.cfg.arch}} (${{matrix.cfg.cpp-version}})
     runs-on: ${{matrix.cfg.os}}
     strategy:
@@ -116,6 +122,8 @@ jobs:
           path: '${{github.workspace}}/build/*.rpm'
 
   macos:
+    permissions:
+      contents: write
     name: macOS x64
     runs-on: macos-latest
     steps:
@@ -141,6 +149,8 @@ jobs:
           DONT_RUN_VCPKG: true
 
   windows: # Windows x64 and x86 build matrix
+    permissions:
+      contents: write
     strategy:
       fail-fast: false # Don't cancel other matrix jobs if one fails
       matrix:
@@ -206,6 +216,8 @@ jobs:
           path: '${{github.workspace}}/main/build/*.zip'
 
   cross-compiles:
+    permissions:
+      contents: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/construct-vcpkg-info.yml

@@ -5,8 +5,13 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   Collect-Vcpkg-Info:
+    permissions:
+      contents: write # Allow the creation of a release.
     runs-on: ubuntu-latest
     steps:
          - name: Harden Runner

.github/workflows/docker.yml

@@ -7,8 +7,14 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   docker:
+    permissions:
+      deployments: write # Docker needs to be able to deploy and package.
+      packages: write
     if: github.repository == 'brainboxdotcc/DPP'
     runs-on: ubuntu-latest
     concurrency: 

.github/workflows/documentation-check.yml

@@ -12,6 +12,9 @@ on:
     files:
       - '**/documentation-check.yml'
 
+permissions:
+  contents: read # This only needs to read the contents of a PR.
+
 jobs:
   docs:
     name: Check Documentation Spelling

.github/workflows/documentation.yml

@@ -9,8 +9,13 @@ on:
       - '**/*.h'
       - '**/documentation.yml'
 
+permissions:
+  contents: read
+
 jobs:
   docs:
+    permissions:
+      contents: write # Needs to be able to write to the repo.
     name: Build Documentation
     runs-on: ubuntu-20.04
 

.github/workflows/gitguardian.yml

@@ -2,6 +2,9 @@ name: GitGuardian scan
 
 on: [push]
 
+permissions:
+  contents: read # GitGuardian only needs to read.
+
 jobs:
   scanning:
     name: GitGuardian scan

.github/workflows/labeler.yml

@@ -8,8 +8,7 @@ permissions:
 jobs:
   triage:
     permissions:
-      contents: read
-      pull-requests: write
+      pull-requests: write # Labeler needs to be able to add labels to PRs.
     runs-on: ubuntu-latest
     steps:
     - name: Harden Runner

.github/workflows/sitemap.yml

@@ -3,8 +3,13 @@ on:
   schedule:
     - cron: '0 6 * * 6'
 
+permissions:
+  contents: read
+
 jobs:
   updater:
+    permissions:
+      contents: write # Needs to be able to write to the repo.
     name: Generate Sitemap
     if: github.repository == 'brainboxdotcc/DPP'
     runs-on: ubuntu-20.04

.github/workflows/stale.yml

@@ -3,8 +3,14 @@ on:
   schedule:
     - cron: '30 1 * * *'
 
+permissions:
+  contents: read # By default, only read.
+
 jobs:
   stale:
+    permissions:
+      issues: write  # for actions/stale to close stale issues
+      pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/target-master.yml

@@ -5,8 +5,13 @@ on:
     branches:
       - 'master'
 
+permissions:
+  contents: read
+
 jobs:
   run:
+    permissions:
+      pull-requests: write # Needs to be able to close a PR.
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner

.github/workflows/test-docs-examples.yml

@@ -11,6 +11,9 @@ on:
       - '**Doxyfile'
       - '**docpages/example_code/**'
   workflow_dispatch:
+
+permissions:
+  contents: read
 
 jobs:
   test_docs_examples: