remove permissions: write-all from workflows

It is dangerous that have this for untrusted workflows
and trusted workflows should have it by default

Author: strtgbb

.github/workflows/backport_branches.yml

@@ -34,8 +34,7 @@ env:
   AZURE_STORAGE_ACCOUNT_URL: "https://${{ secrets.AZURE_ACCOUNT_NAME }}.blob.core.windows.net/"
   ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
 
-# Allow updating GH commit statuses and PR comments to post an actual job reports link
-permissions: write-all
+
 
 jobs:
 

.github/workflows/master.yml

@@ -33,8 +33,7 @@ env:
   AZURE_STORAGE_ACCOUNT_URL: "https://${{ secrets.AZURE_ACCOUNT_NAME }}.blob.core.windows.net/"
   ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
 
-# Allow updating GH commit statuses and PR comments to post an actual job reports link
-permissions: write-all
+
 
 jobs:
 

.github/workflows/pull_request.yml

@@ -34,8 +34,7 @@ env:
   AZURE_STORAGE_ACCOUNT_URL: "https://${{ secrets.AZURE_ACCOUNT_NAME }}.blob.core.windows.net/"
   ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
 
-# Allow updating GH commit statuses and PR comments to post an actual job reports link
-permissions: write-all
+
 
 jobs:
 

.github/workflows/pull_request_external.yml

@@ -21,8 +21,7 @@ env:
   DISABLE_CI_CACHE: ${{ github.event.inputs.no_cache || '0' }}
   CHECKOUT_REF: ${{ vars.DISABLE_CI_MERGE_COMMIT == '1' && github.event.pull_request.head.sha || '' }}
 
-# Allow updating GH commit statuses and PR comments to post an actual job reports link
-permissions: write-all
+
 
 jobs:
 

.github/workflows/release_branches.yml

@@ -33,8 +33,7 @@ env:
   AZURE_STORAGE_ACCOUNT_URL: "https://${{ secrets.AZURE_ACCOUNT_NAME }}.blob.core.windows.net/"
   ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
 
-# Allow updating GH commit statuses and PR comments to post an actual job reports link
-permissions: write-all
+
 
 jobs:
 

ci/praktika/yaml_generator.py

@@ -55,10 +55,8 @@ class Templates:
 jobs:
 {JOBS}\
 """
-        TEMPLATE_GH_TOKEN_PERMISSIONS = """\
-# Allow updating GH commit statuses and PR comments to post an actual job reports link
-permissions: write-all\
-"""
+        # NOTE (strtgbb): This is dangerous to set for untrusted workflows, and for trusted workflows it should already be the default
+        TEMPLATE_GH_TOKEN_PERMISSIONS = ""
         TEMPLATE_ENV_CHECKOUT_REF_PR = """\
   GH_TOKEN: ${{{{ github.token }}}}
   DISABLE_CI_MERGE_COMMIT: ${{{{ vars.DISABLE_CI_MERGE_COMMIT || '0' }}}}