Merge branch 'master' into metric-error-codes

.github/workflows/create-release.yaml

@@ -21,10 +21,14 @@ on:
         required: true 
         type: string
 
+permissions: {}
+
 jobs:
   create-release:
     name: Creates release branch and tag
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Check out code
         uses: actions/checkout@v4
@@ -47,6 +51,8 @@ jobs:
     name: Triggers the Dapr runtime build
     runs-on: ubuntu-latest
     needs: create-release
+    permissions:
+      actions: write
     steps:
       - name: Triggers the build
         env:

.github/workflows/dapr-3rdparty-images.yaml

@@ -5,9 +5,14 @@ on:
     - cron: '0 0 1 * *' # trigger on the 1st of every month at midnight
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   mirror:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - 
         name: Checkout

.github/workflows/dapr-base-containers.yaml

@@ -19,6 +19,9 @@ on:
   # Dispatch on external events
   repository_dispatch:
     types: [windows-base]
+
+permissions: {}
+
 jobs:
   build:
     strategy:
@@ -30,6 +33,9 @@ jobs:
             windows-version: "ltsc2022"
     name: Build base Windows images
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      packages: write
     env:
       WINDOWS_VERSION: ${{ matrix.windows-version }}
       TARGET_OS: windows

.github/workflows/dapr-bot-schedule.yml

@@ -17,11 +17,17 @@ on:
   schedule:
     - cron: '*/10 * * * *'
   workflow_dispatch:
+
+permissions: {}
+
 jobs:
   automerge:
     if: github.repository_owner == 'dapr'
     name: Automerge and update PRs.
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
@@ -35,6 +41,10 @@ jobs:
   prune_stale:
     name: Prune Stale
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
     steps:
     - name: Prune Stale
       uses: actions/[email protected]

.github/workflows/dapr-bot.yml

@@ -6,10 +6,17 @@ on:
   issues:
     types: [labeled]
 
+permissions: {}
+
 jobs:
   daprbot:
     name: bot-processor
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      actions: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4 # required to make the script available for next step

.github/workflows/dapr-dev-container.yml

@@ -19,10 +19,15 @@ on:
     # Run weekly on Tuesdays
     - cron: "22 03 * * 2"
 
+permissions: {}
+
 jobs:
   build:
     name: build dev container
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: write
     env:
       DOCKER_REGISTRY: ${{ secrets.DOCKER_REGISTRY }}
     steps:

.github/workflows/dapr-perf-components.yml

@@ -30,6 +30,9 @@ on:
   # Dispatch on external events
   repository_dispatch:
     types: [components-perf-test]
+
+permissions: {}
+
 env:
   # Configure proxy for Go modules
   GOPROXY: https://proxy.golang.org
@@ -50,6 +53,9 @@ jobs:
   deploy-infrastructure:
     name: Deploy test infrastructure
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Set up for scheduled test
         if: github.event_name != 'repository_dispatch'
@@ -184,6 +190,9 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       GOOS: linux
       GOARCH: amd64
@@ -313,6 +322,9 @@ jobs:
       - build
       - deploy-infrastructure
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       GOOS: linux
       GOARCH: amd64

.github/workflows/dapr-perf.yml

@@ -37,6 +37,8 @@ on:
   repository_dispatch:
     types: [perf-test]
 
+permissions: {}
+
 env:
   # Configure proxy for Go modules
   GOPROXY: https://proxy.golang.org
@@ -57,6 +59,9 @@ jobs:
   deploy-infrastructure:
     name: Deploy test infrastructure
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Set up for manual runs
         if: github.event_name == 'workflow_dispatch'
@@ -198,6 +203,9 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       GOOS: linux
       GOARCH: amd64
@@ -333,6 +341,9 @@ jobs:
       - build
       - deploy-infrastructure
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       GOOS: linux
       GOARCH: amd64

.github/workflows/dapr-release-notes.yml

@@ -15,10 +15,15 @@ name: dapr-release-notes
 
 on:
   workflow_dispatch:
+
+permissions: {}
+
 jobs:
   build:
     name: Generate release notes
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4

.github/workflows/dapr-standalone-validation.yml

@@ -29,17 +29,30 @@ on:
       - release-*
       - feature/*
 
+permissions: {}
+
 jobs:
   validate-virt-mem:
     name: Standalone validations
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       GOOS: linux
       GOARCH: amd64
       DAPR_INSTALL_URL: https://raw.githubusercontent.com/dapr/cli/master/install/install.sh
     steps:
-      - name: Install required packages
-        run: pip3 install scipy psutil
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+      - name: Upgrade pip
+        run: |
+          python3 -m ensurepip --upgrade
+          python3 -m pip install --upgrade pip
+      - name: Install required Python packages
+        run: |
+          python3 -m pip install numpy scipy psutil requests
       # This is a good example where we want to always compare against the latest stable release.
       # Pinning to a given Dapr version does not add any value in this workflow.
       - name: Install latest Dapr CLI

.github/workflows/dapr-test-azure-cleanup.yml

@@ -23,6 +23,8 @@ on:
   # Manual trigger
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   cleanup:
     runs-on: ubuntu-latest

.github/workflows/dapr-test-cache-clean.yml

@@ -22,6 +22,8 @@ on:
   # Manual trigger
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   cleanup:
     runs-on: ubuntu-22.04

.github/workflows/dapr-test-sdk.yml

@@ -34,6 +34,8 @@ env:
   GOARCH: amd64
   GOPROXY: https://proxy.golang.org
 
+permissions: {}
+
 # Job(s) can be triggered with the following commands:
   # /test-sdk-all
   # /test-sdk-python
@@ -52,6 +54,9 @@ jobs:
       )
     name: "Python SDK verification tests"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write    
     steps:
       - name: Set up for scheduled test
         if: github.event_name != 'repository_dispatch'
@@ -178,6 +183,9 @@ jobs:
       )
     name: "Java SDK verification tests"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       JDK_VER: 11
       JAVA_SPRING_BOOT_VERSION: 2.7.8
@@ -340,6 +348,9 @@ jobs:
       )
     name: "JS SDK verification tests"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       NODE_VER: 18
     services:
@@ -481,6 +492,9 @@ jobs:
       )
     name: "Go SDK verification tests"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Set up for scheduled test
         if: github.event_name != 'repository_dispatch'

.github/workflows/dapr-test.yml

@@ -33,6 +33,9 @@ on:
   # Dispatch on external events
   repository_dispatch:
     types: [e2e-test]
+
+permissions: {}
+
 env:
   # Configure proxy for Go modules
   GOPROXY: https://proxy.golang.org
@@ -71,6 +74,9 @@ jobs:
   deploy-infrastructure:
     name: Deploy test infrastructure
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Set up for manual runs
         if: github.event_name == 'workflow_dispatch'
@@ -217,6 +223,9 @@ jobs:
   build:
     name: Build for  ${{ matrix.target_os }} on ${{ matrix.target_arch }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       GOOS: ${{ matrix.target_os }}
       GOARCH: ${{ matrix.target_arch }}
@@ -390,6 +399,9 @@ jobs:
       - deploy-infrastructure
     # Always run on Linux as the local OS is irrelevant and this is faster
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
     env:
       TARGET_OS: ${{ matrix.target_os }}
       TARGET_ARCH: ${{ matrix.target_arch }}