ci: update of files from global .github repo

Author: asyncapi-bot

.github/workflows/bump.yml

@@ -13,6 +13,9 @@ on:
     branches:
       - master
 
+permissions:
+  contents: read  # To checkout code
+
 jobs:
   bump-in-dependent-projects:
     name: Bump this package in repositories that depend on it
@@ -21,9 +24,11 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Check if Node.js project and has package.json
         id: packagejson
-        run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT
+        run: test -e ./package.json && echo "exists=true" >> "$GITHUB_OUTPUT" || echo "exists=false" >> "$GITHUB_OUTPUT"
       - name: Setup corepack with pnpm and yarn
         if: steps.packagejson.outputs.exists == 'true'
         run: corepack enable

.github/workflows/if-nodejs-release.yml

@@ -18,13 +18,9 @@ on:
       - next
 
 permissions:
-  contents: write # to be able to publish a GitHub release
-  issues: write # to be able to comment on released issues
-  pull-requests: write # to be able to comment on released pull requests
-  id-token: write # to enable use of OIDC for trusted publishing and npm provenance
+  contents: read
 
 jobs:
-
   test-nodejs:
     # We just check the message of first commit as there is always just one commit because we squash into one before merging
     # "commits" contains array of objects where one of the properties is commit "message"
@@ -48,9 +44,11 @@ jobs:
         shell: bash
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Check if Node.js project and has package.json
         id: packagejson
-        run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT
+        run: test -e ./package.json && echo "exists=true" >> "$GITHUB_OUTPUT" || echo "exists=false" >> "$GITHUB_OUTPUT"
         shell: bash
       - if: steps.packagejson.outputs.exists == 'true'
         name: Determine what node version to use
@@ -90,16 +88,23 @@ jobs:
     needs: [test-nodejs]
     name: Publish to any of NPM, Github, or Docker Hub
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for trusted publishing and npm provenance
     steps:
       - name: Set git to use LF #to once and for all finish neverending fight between Unix and Windows
         run: |
           git config --global core.autocrlf false
           git config --global core.eol lf
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Check if Node.js project and has package.json
         id: packagejson
-        run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT
+        run: test -e ./package.json && echo "exists=true" >> "$GITHUB_OUTPUT" || echo "exists=false" >> "$GITHUB_OUTPUT"
         shell: bash
       - if: steps.packagejson.outputs.exists == 'true'
         name: Determine what node version to use

.github/workflows/if-nodejs-version-bump.yml

@@ -9,10 +9,15 @@ on:
     types: 
       - published
 
+permissions: {}
+
 jobs:
   version_bump:
     name: Generate assets and bump NodeJS
     runs-on: ubuntu-latest
+    permissions:
+      contents: write                 # required to create PR with bumped version in package.json   
+      pull-requests: write            # required to create PR with bumped version in package.json
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -21,9 +26,10 @@ jobs:
           # in case release is created from release branch then we need to checkout from given branch
           # if @semantic-release/github is used to publish, the minimum version is 7.2.0 for proper working
           ref: ${{ github.event.release.target_commitish }}
+          persist-credentials: false
       - name: Check if Node.js project and has package.json
         id: packagejson
-        run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT
+        run: test -e ./package.json && echo "exists=true" >> "$GITHUB_OUTPUT" || echo "exists=false" >> "$GITHUB_OUTPUT"
       - if: steps.packagejson.outputs.exists == 'true'
         name: Determine what node version to use
         # This workflow is from our own org repo and safe to reference by 'master'.
@@ -59,7 +65,7 @@ jobs:
           RELEASE_TAG: ${{github.event.release.tag_name}}
           RELEASE_URL: ${{github.event.release.html_url}}
         with:
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ github.token }}
           commit-message: 'chore(release): ${{ env.RELEASE_TAG }}'
           committer: asyncapi-bot <info@asyncapi.io>
           author: asyncapi-bot <info@asyncapi.io>