chore: add job-level permissions to all CI workflows

.github/workflows/ci_codegen.yml

@@ -10,6 +10,10 @@ on:
 
 jobs:
   code-generation:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     strategy:
       fail-fast: false
       matrix:

.github/workflows/ci_duvet.yml

@@ -11,6 +11,10 @@ on:
 
 jobs:
   duvet:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci_static_analysis.yml

@@ -9,6 +9,10 @@ on:
 
 jobs:
   not-grep:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v6

.github/workflows/ci_todos.yml

@@ -9,6 +9,10 @@ on:
 
 jobs:
   findTodos:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     runs-on: macos-14
     steps:
       - uses: actions/checkout@v6

.github/workflows/dafny-interop.yml

@@ -22,10 +22,18 @@ on:
 
 jobs:
   getMplHeadVersion:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     uses: ./.github/workflows/mpl_head_version.yml
     with:
       mpl-head: ${{inputs.mpl-commit}}
   dafny-interop-java:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_java.yml
     with:
@@ -34,6 +42,10 @@ jobs:
       mpl-version: ${{needs.getMplHeadVersion.outputs.version}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-java-test-vectors:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_test_vector_java.yml
     with:
@@ -42,6 +54,10 @@ jobs:
       mpl-version: ${{needs.getMplHeadVersion.outputs.version}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-java-examples:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getMplHeadVersion
     uses: ./.github/workflows/dafny_interop_examples_java.yml
     with:
@@ -50,18 +66,30 @@ jobs:
       mpl-version: ${{needs.getMplHeadVersion.outputs.version}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-net:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     uses: ./.github/workflows/dafny_interop_test_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}
       mpl-commit: ${{inputs.mpl-commit}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-net-test-vectors:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     uses: ./.github/workflows/dafny_interop_test_vector_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}
       mpl-commit: ${{inputs.mpl-commit}}
       dbesdk-dafny: ${{inputs.dbesdk-dafny}}
   dafny-interop-net-examples:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     uses: ./.github/workflows/dafny_interop_examples_net.yml
     with:
       mpl-dafny: ${{inputs.mpl-dafny}}

.github/workflows/dafny_verify_version.yml

@@ -12,6 +12,10 @@ on:
 
 jobs:
   getDafnyVerifyVersion:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.read_property.outputs.dafnyVerifyVersion }}

.github/workflows/dafny_version.yml

@@ -12,6 +12,10 @@ on:
 
 jobs:
   getDafnyVersion:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     runs-on: ubuntu-22.04
     outputs:
       version: ${{ steps.read_property.outputs.dafnyVersion }}

.github/workflows/daily_ci.yml

@@ -13,71 +13,127 @@ on:
 
 jobs:
   getVersion:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     # Don't run the cron builds on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/dafny_version.yml
   getVerifyVersion:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/dafny_verify_version.yml
   daily-ci-format:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/library_format.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-codegen:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/ci_codegen.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-verification:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVerifyVersion
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     uses: ./.github/workflows/library_dafny_verification.yml
     with:
       dafny: ${{needs.getVerifyVersion.outputs.version}}
   daily-ci-test-vector-verification:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVerifyVersion
     uses: ./.github/workflows/test_vector_verification.yml
     with:
       dafny: ${{needs.getVerifyVersion.outputs.version}}
   daily-ci-java:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-java-test-vectors:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_vector_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-java-examples:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_examples_java.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-rust:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/library_rust_tests.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net-test-vectors:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_test_vector_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   daily-ci-net-examples:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs: getVersion
     uses: ./.github/workflows/ci_examples_net.yml
     with:
       dafny: ${{needs.getVersion.outputs.version}}
   notify:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     needs:
       [
         getVersion,
@@ -94,7 +150,7 @@ jobs:
         daily-ci-net-test-vectors,
         daily-ci-net-examples,
       ]
-    if: ${{ failure() }}
+    if: ${{ failure() && github.event_name == 'schedule'}}
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with:
       message: "Daily CI failed on `${{ github.repository }}`. View run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"

.github/workflows/go-release.yml

@@ -14,6 +14,10 @@ on:
 
 jobs:
   get-dafny-version:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     uses: ./.github/workflows/dafny_version.yml
 
   go-release:

.github/workflows/issue-notification.yml

@@ -7,6 +7,10 @@ on:
 
 jobs:
   notify-issue:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     if: github.event_name == 'issues'
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with:
@@ -15,6 +19,10 @@ jobs:
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_GHI }}
 
   notify-comment:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     if: github.event_name == 'issue_comment' && !github.event.issue.pull_request
     uses: aws/aws-cryptographic-material-providers-library/.github/workflows/slack-notification.yml@main
     with:

.github/workflows/library_dafny_verification.yml

@@ -25,6 +25,10 @@ on:
 
 jobs:
   verification:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     # Don't run the nightly build on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     strategy:

.github/workflows/library_format.yml

@@ -15,6 +15,10 @@ on:
         type: boolean
 jobs:
   format_projects:
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
     # Don't run the nightly build on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'aws'
     strategy: