ci: add workflow permissions

Author: alexfreska

.github/workflows/e2e-merge-reports.yml

@@ -1,5 +1,9 @@
 name: Merge e2e test reports
 
+permissions:
+  contents: read
+  actions: write # Needed for actions/upload-artifact to upload the merged HTML report.
+
 on:
   workflow_call:
     inputs:

.github/workflows/e2e-shard-tests.yml

@@ -1,5 +1,9 @@
 name: Run sharded e2e tests
 
+permissions:
+  contents: read
+  actions: write # Needed to upload blob reports as artifacts.
+
 on:
   workflow_call:
     inputs:

.github/workflows/e2e.yml

@@ -1,5 +1,8 @@
 name: e2e
 
+permissions:
+  contents: read
+
 on:
   workflow_call:
     secrets:

.github/workflows/pr.yml

@@ -1,5 +1,8 @@
 name: PR
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: [opened, synchronize, reopened, closed]

.github/workflows/project-add.yml

@@ -1,5 +1,8 @@
 name: Add issues and PRs to Sia project
 
+permissions:
+  contents: read
+
 on:
   issues:
     types:

.github/workflows/release-beta.yml

@@ -1,5 +1,8 @@
 name: Manually Release a Beta Tag to NPM and GitHub
 
+permissions:
+  contents: write # Needed by changesets/action to create releases and update tags.
+
 on:
   push:
     branches:

.github/workflows/release-go.yml

@@ -1,11 +1,13 @@
 name: Release Go modules
 
+permissions:
+  contents: read # Read is sufficient because pushes use PAT, not GITHUB_TOKEN perms.
+
 concurrency: commits-to-main
 
 on:
   repository_dispatch:
     types: [release-go]
-  # Enable manual trigger
   workflow_dispatch:
 
 jobs:
@@ -40,23 +42,3 @@ jobs:
           git push origin main --tags
           # cleanup
           git branch -D release
-      # Disabled in favor of Dependabot.
-      # Leaving here in case we ever want to re-enable.
-      # - name: Create UI PR on renterd repo
-      #   uses: peter-evans/repository-dispatch@v3
-      #   with:
-      #     token: ${{ secrets.PAT_REPOSITORY_DISPATCH }}
-      #     repository: siafoundation/renterd
-      #     event-type: update-ui
-      # - name: Create UI PR on hostd repo
-      #   uses: peter-evans/repository-dispatch@v3
-      #   with:
-      #     token: ${{ secrets.PAT_REPOSITORY_DISPATCH }}
-      #     repository: siafoundation/hostd
-      #     event-type: update-ui
-      # - name: Create UI PR on walletd repo
-      #   uses: peter-evans/repository-dispatch@v3
-      #   with:
-      #     token: ${{ secrets.PAT_REPOSITORY_DISPATCH }}
-      #     repository: siafoundation/walletd
-      #     event-type: update-ui

.github/workflows/release-main.yml

@@ -1,5 +1,10 @@
 name: Update Release PR or Release Versions and Publish
 
+permissions:
+  contents: write # Required for changesets/action to commit/version and create releases.
+  pull-requests: write # Needed to update the release PR during versioning.
+  packages: write # Needed to push Docker images to GHCR via docker/login-action.
+
 on:
   push:
     branches:

.github/workflows/release-manual.yml

@@ -1,5 +1,10 @@
 name: Release Versions and Publish
 
+permissions:
+  contents: write # Required for changesets/action to publish releases and tags.
+  pull-requests: write # Allows updating release PRs if needed.
+  packages: write # Allows pushing Docker images to GHCR if containers are built.
+
 on:
   workflow_dispatch: