ci: Restict permissions in Actions (#1019)

This change adds a `permissions` block to all actions and ensures that
we use SHA-pinned versions of all external actions. This helps ensure
that our actions use limited GitHub permissions.

This change also removes the unused docker CI workflow.

Author: olix0r

.github/workflows/advisory.yml

@@ -9,6 +9,8 @@ jobs:
   advisories:
     timeout-minutes: 5
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
     - uses: EmbarkStudios/cargo-deny-action@0ca727bbae7b7b578b9a5f98186caac35aa2a00d # v1.2.6
@@ -23,6 +25,8 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: docker://rust:1.52.1-buster
+    permissions:
+      contents: read
     strategy:
       matrix:
         dir:
@@ -47,6 +51,8 @@ jobs:
   release-binary:
     timeout-minutes: 15
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
       - run: make build

.github/workflows/docker.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   package:
+    permissions:
+      contents: write
     strategy:
       matrix:
         architecture: [amd64, arm64, arm]
@@ -25,7 +27,7 @@ jobs:
     timeout-minutes: 40
     steps:
       - name: git co
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
 
       - name: meta
         id: release-tag-meta
@@ -53,7 +55,7 @@ jobs:
           args: /linkerd/expected-checksec.json "target/${{ matrix.target }}/release/package/linkerd2-proxy-${{ steps.release-tag-meta.outputs.name }}-${{ matrix.architecture }}-checksec.json"
 
       - name: upload artifacts
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@ee69f02b3dfdecd58bb31b4d133da38ba6fe3700 # v2.2.3
         with:
           name: ${{ matrix.architecture }}-artifacts
           path: target/${{ matrix.target }}/release/package/*
@@ -63,9 +65,11 @@ jobs:
     name: GitHub Release
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      contents: write
     steps:
       - name: git co
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
 
       - name: meta
         id: release-tag-meta
@@ -74,15 +78,15 @@ jobs:
           git-ref: ${{ github.ref }}
 
       - name: download artifacts
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@158ca71f7c614ae705e79f25522ef4658df18253 # v2.0.9
         with:
           path: artifacts
 
       - name: display structure of downloaded files
         run: ls -R artifacts
 
       - name: release
-        uses: softprops/action-gh-release@affa18ef97bc9db20076945705aba8c516139abd
+        uses: softprops/action-gh-release@b7e450da2a4b4cb4bfbae528f788167786cfcedf # v0.1.5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/release.yml

@@ -11,6 +11,8 @@ jobs:
   audit:
     timeout-minutes: 5
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
     - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
     - uses: EmbarkStudios/cargo-deny-action@0ca727bbae7b7b578b9a5f98186caac35aa2a00d # v1.2.6
@@ -23,6 +25,8 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: docker://rust:1.52.1-buster
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
       - run: rustup component add clippy
@@ -34,6 +38,8 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: docker://rust:1.52.1-buster
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
       - run: for d in $(for toml in $(find . -mindepth 2 -name Cargo.toml -not -path '*/fuzz/*') ; do echo ${toml%/*} ; done | sort -r ) ; do echo "# $d" ; (cd $d ; cargo check --all-targets) ; done
@@ -44,6 +50,8 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: docker://rust:1.52.1-buster
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
       - run: rustup component add rustfmt
@@ -53,6 +61,8 @@ jobs:
   test:
     timeout-minutes: 15
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
       - run: make test