Tighten up the GitHub Actions workflow permissions.

Author: johnbillion

.github/workflows/cs.yml

@@ -13,10 +13,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   actionlint: #----------------------------------------------------------------------
     name: 'Check GHA workflows'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code
@@ -41,6 +45,8 @@ jobs:
   phpcs: #----------------------------------------------------------------------
     name: 'PHPCS'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout code

.github/workflows/label-merge-conflicts.yml

@@ -13,10 +13,14 @@ on:
       - synchronize
       - reopened
 
+permissions: {}
+
 jobs:
   check-prs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'WordPress'
+    permissions:
+      pull-requests: write
 
     name: Check PRs for merge conflicts
 

.github/workflows/lint.yml

@@ -13,9 +13,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   lint: #----------------------------------------------------------------------
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       matrix:

.github/workflows/quicktest.yml

@@ -13,11 +13,15 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   #### QUICK TEST STAGE ####
   # Runs the tests against select PHP versions for pushes to arbitrary branches.
   quicktest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       matrix:

.github/workflows/reusable-update-cacert.yml

@@ -3,11 +3,17 @@ name: Certificates
 on:
   workflow_call:
 
+permissions: {}
+
 jobs:
   certificate-check:
     name: "Check for updated certificate bundle"
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
     steps:
       - name: Determine branches to use
         id: branches

.github/workflows/test.yml

@@ -14,10 +14,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   #### TEST STAGE ####
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       # Keys:

.github/workflows/update-cacert-cron.yml

@@ -11,9 +11,14 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   certificate-check:
     # Don't run the cron job on forks.
     if: ${{ github.event.repository.fork == false }}
+    permissions:
+      contents: write
+      pull-requests: write
 
     uses: ./.github/workflows/reusable-update-cacert.yml

.github/workflows/update-cacert.yml

@@ -24,6 +24,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   certificate-check:
+    permissions:
+      contents: write
+      pull-requests: write
+
     uses: ./.github/workflows/reusable-update-cacert.yml

.github/workflows/update-website.yml

@@ -21,9 +21,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  pull-requests: write
-  contents: write
+permissions: {}
 
 jobs:
   prepare:
@@ -32,6 +30,9 @@ jobs:
     if: github.repository == 'WordPress/Requests'
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
     steps:
       # By default use the `stable` branch as the published docs should always
       # reflect the latest release.
@@ -91,6 +92,10 @@ jobs:
     if: github.repository == 'WordPress/Requests'
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+
     steps:
       # PRs based on the "pull request" event trigger will contain changes from the
       # current `develop` branch, so should not be published as the website should