Backport workflow-hardening fix (excessive-permissions) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/claim-pypi-name.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 5dbed44

Affected release branches (5)

• 7.80.x (still present as of HEAD 4b25dd79)
• 7.77.x (still present as of HEAD 0b340309)
• 7.81.x (still present as of HEAD c98b1a75)
• 7.78.x (still present as of HEAD 887e765b)
• 7.79.x (still present as of HEAD 3d7e9164)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

7.80.x — excessive-permissions

File .github/workflows/claim-pypi-name.yaml; suggested edits:

• • jobs.$J.permissions.id-token = 'write'

--- a/.github/workflows/claim-pypi-name.yaml
+++ b/.github/workflows/claim-pypi-name.yaml
@@ -49,3 +49,5 @@
           skip-existing: true
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
+    permissions:
+      id-token: write

7.77.x — excessive-permissions

File .github/workflows/claim-pypi-name.yaml; suggested edits:

• • jobs.$J.permissions.id-token = 'write'

--- a/.github/workflows/claim-pypi-name.yaml
+++ b/.github/workflows/claim-pypi-name.yaml
@@ -49,3 +49,5 @@
           skip-existing: true
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
+    permissions:
+      id-token: write

7.81.x — excessive-permissions

File .github/workflows/claim-pypi-name.yaml; suggested edits:

• • jobs.$J.permissions.id-token = 'write'

--- a/.github/workflows/claim-pypi-name.yaml
+++ b/.github/workflows/claim-pypi-name.yaml
@@ -49,3 +49,5 @@
           skip-existing: true
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
+    permissions:
+      id-token: write

7.78.x — excessive-permissions

File .github/workflows/claim-pypi-name.yaml; suggested edits:

• • jobs.$J.permissions.id-token = 'write'

--- a/.github/workflows/claim-pypi-name.yaml
+++ b/.github/workflows/claim-pypi-name.yaml
@@ -49,3 +49,5 @@
           skip-existing: true
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
+    permissions:
+      id-token: write

7.79.x — excessive-permissions

File .github/workflows/claim-pypi-name.yaml; suggested edits:

• • jobs.$J.permissions.id-token = 'write'

--- a/.github/workflows/claim-pypi-name.yaml
+++ b/.github/workflows/claim-pypi-name.yaml
@@ -49,3 +49,5 @@
           skip-existing: true
           user: __token__
           password: ${{ secrets.PYPI_TOKEN }}
+    permissions:
+      id-token: write

---

Happy to open pull requests instead if that's preferred.

[AAraKKe]

Closing this issue. Name claiming is not done through jwt and that was already removed. We will be updating the workflow in the near future.