ci: Add contents: read permission to reusable worflow callers

Techassi · Techassi · commit 307b657b7f66 · 2026-04-07T13:04:11.000+02:00
diff --git a/.github/workflows/build_airflow.yaml b/.github/workflows/build_airflow.yaml
@@ -31,6 +31,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: airflow
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_druid.yaml b/.github/workflows/build_druid.yaml
@@ -33,6 +33,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: druid
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_hadoop.yaml b/.github/workflows/build_hadoop.yaml
@@ -33,6 +33,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: hadoop
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_hbase.yaml b/.github/workflows/build_hbase.yaml
@@ -34,6 +34,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: hbase
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_hive.yaml b/.github/workflows/build_hive.yaml
@@ -34,6 +34,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: hive
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_java-base.yaml b/.github/workflows/build_java-base.yaml
@@ -29,6 +29,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: java-base
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_java-devel.yaml b/.github/workflows/build_java-devel.yaml
@@ -29,6 +29,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: java-devel
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_kafka-testing-tools.yaml b/.github/workflows/build_kafka-testing-tools.yaml
@@ -33,6 +33,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: kafka-testing-tools
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_kafka.yaml b/.github/workflows/build_kafka.yaml
@@ -34,6 +34,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: kafka
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_krb5.yaml b/.github/workflows/build_krb5.yaml
@@ -29,6 +29,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: krb5
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_nifi.yaml b/.github/workflows/build_nifi.yaml
@@ -33,6 +33,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: nifi
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_omid.yaml b/.github/workflows/build_omid.yaml
@@ -33,6 +33,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: omid
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_opa.yaml b/.github/workflows/build_opa.yaml
@@ -31,6 +31,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: opa
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_opensearch.yaml b/.github/workflows/build_opensearch.yaml
@@ -34,6 +34,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: opensearch
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_opensearch_dashboards.yaml b/.github/workflows/build_opensearch_dashboards.yaml
@@ -32,6 +32,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: opensearch-dashboards
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_spark-connect-client.yaml b/.github/workflows/build_spark-connect-client.yaml
@@ -32,6 +32,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: spark-connect-client
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_spark-k8s.yaml b/.github/workflows/build_spark-k8s.yaml
@@ -34,6 +34,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: spark-k8s
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_stackable-base.yaml b/.github/workflows/build_stackable-base.yaml
@@ -30,6 +30,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: stackable-base
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_superset.yaml b/.github/workflows/build_superset.yaml
@@ -31,6 +31,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: superset
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_testing-tools.yaml b/.github/workflows/build_testing-tools.yaml
@@ -37,6 +37,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: ${{ matrix.product-name }}
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_tools.yaml b/.github/workflows/build_tools.yaml
@@ -30,6 +30,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: tools
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_trino-cli.yaml b/.github/workflows/build_trino-cli.yaml
@@ -32,6 +32,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: trino-cli
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_trino.yaml b/.github/workflows/build_trino.yaml
@@ -33,6 +33,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: trino
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_vector.yaml b/.github/workflows/build_vector.yaml
@@ -29,6 +29,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: vector
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
diff --git a/.github/workflows/build_zookeeper.yaml b/.github/workflows/build_zookeeper.yaml
@@ -33,6 +33,8 @@ jobs:
     secrets:
       harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
       slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
+    permissions:
+      contents: read
     with:
       product-name: zookeeper
       sdp-version: ${{ github.ref_type == 'tag' && github.ref_name || '0.0.0-dev' }}
