Merge pull request #20333 from Michael-Gardner/HPCC-34812

HPCC-34812 Explicit write permissions in github actions

Author: GordonSmith

.github/workflows/build-assets.yml

@@ -99,6 +99,9 @@ jobs:
   build-docker-community:
     name: Build Docker Community
     needs: preamble
+    permissions:
+      contents: write
+      actions: write
     strategy:
       matrix:
         os: [ ubuntu-24.04, ubuntu-22.04, ubuntu-20.04, rockylinux-8 ]
@@ -124,6 +127,9 @@ jobs:
   build-docker-internal:
     name: Build Docker Internal
     needs: preamble
+    permissions:
+      contents: read
+      actions: write
     strategy:
       matrix:
         os: [ ubuntu-24.04, ubuntu-22.04, ubuntu-20.04, rockylinux-8, centos-7 ]
@@ -150,6 +156,9 @@ jobs:
   build-docker-enterprise:
     name: Build Docker Enterprise
     needs: preamble
+    permissions:
+      contents: read
+      actions: write
     strategy:
       matrix:
         os: [ ubuntu-24.04, ubuntu-22.04 ]
@@ -162,6 +171,9 @@ jobs:
 
   build-documentation:
     needs: preamble
+    permissions:
+      contents: write
+      actions: write
     uses: ./.github/workflows/build-documentation.yml
     with:
       community-ref: ${{ needs.preamble.outputs.community_ref }}
@@ -176,6 +188,9 @@ jobs:
 
   build-clienttools-community-macos:
     needs: preamble
+    permissions:
+      contents: write
+      actions: write
     uses: ./.github/workflows/build-clienttools-macos-13.yml
     with:
       community-ref: ${{ needs.preamble.outputs.community_ref }}
@@ -184,6 +199,9 @@ jobs:
 
   build-clienttools-internal-macos:
     needs: preamble
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/build-clienttools-macos-13.yml
     with:
       community-ref: ${{ needs.preamble.outputs.community_ref }}
@@ -193,6 +211,9 @@ jobs:
 
   build-clienttools-community-windows:
     needs: preamble
+    permissions:
+      contents: write
+      actions: write
     uses: ./.github/workflows/build-clienttools-windows-2022.yml
     with:
       community-ref: ${{ needs.preamble.outputs.community_ref }}
@@ -203,6 +224,9 @@ jobs:
 
   build-clienttools-internal-windows:
     needs: preamble
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/build-clienttools-windows-2022.yml
     with:
       community-ref: ${{ needs.preamble.outputs.community_ref }}
@@ -212,6 +236,9 @@ jobs:
 
   build-bare-metal-eclide:
     needs: [ preamble, build-clienttools-community-windows, build-documentation ]
+    permissions:
+      contents: write
+      actions: write
     uses: ./.github/workflows/build-eclide.yml
     with:
       community-ref: ${{ needs.preamble.outputs.community_ref }}
@@ -223,6 +250,8 @@ jobs:
 
   changelogs:
     needs: preamble
+    permissions:
+      contents: write
     uses: ./.github/workflows/build-changelogs.yml
     with:
       current-version: ${{ needs.preamble.outputs.hpcc_version_full }}

.github/workflows/build-changelogs.yml

@@ -33,6 +33,8 @@ jobs:
     name: Generate Changelogs
     runs-on: ubuntu-latest
     if: ${{ github.repository_owner == 'hpcc-systems' }}
+    permissions:
+      contents: write
     steps:
       - name: Checkout HPCC-Platform
         uses: actions/checkout@v4

.github/workflows/build-vcpkg.yml

@@ -46,6 +46,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
 
   build-workflow-dispatch:

.github/workflows/test-documentation.yml

@@ -27,6 +27,10 @@ on:
         required: false
         default: 'Documentation'
 
+permissions:
+  contents: read
+  actions: write
+
 jobs:
   build-documentation:
     name: Build Documentation