[StepSecurity] ci: Harden GitHub Actions (#6286)

Signed-off-by: StepSecurity Bot <[email protected]>
Co-authored-by: Rajkumar Rangaraj <[email protected]>
Co-authored-by: Cijo Thomas <[email protected]>

Author: 3 people

.github/workflows/automation.yml

@@ -15,6 +15,9 @@ on:
       OPENTELEMETRYBOT_GITHUB_TOKEN:
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   resolve-automation:
 

.github/workflows/codeql-analysis.yml

@@ -10,8 +10,15 @@ on:
     - cron: '0 0 * * *' # once in a day at 00:00
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/analyze to upload SARIF results
     name: Analyze
     runs-on: windows-latest
 

.github/workflows/concurrency-tests.yml

@@ -5,6 +5,9 @@ name: Concurrency Tests
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-concurrency-tests:
 

.github/workflows/docfx.yml

@@ -5,6 +5,9 @@ name: Build docfx
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-docfx-build:
     runs-on: windows-latest

.github/workflows/dotnet-format.yml

@@ -5,6 +5,9 @@ name: Lint - dotnet format
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-dotnet-format-stable:
     runs-on: windows-latest

.github/workflows/package-validation.yml

@@ -5,6 +5,9 @@ name: Package Validation
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-package-validation-stable:
     runs-on: windows-latest

.github/workflows/sanitycheck.yml

@@ -5,6 +5,9 @@ name: Lint - Spelling & Encoding
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-misspell:
     runs-on: ubuntu-22.04

.github/workflows/stale.yml

@@ -6,8 +6,14 @@ on:
   schedule:
     - cron: "12 3 * * *"  # arbitrary time not to DDOS GitHub
 
+permissions:
+  contents: read
+
 jobs:
   stale:
+    permissions:
+      issues: write  # for actions/stale to close stale issues
+      pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0

.github/workflows/verifyaotcompat.yml

@@ -5,6 +5,9 @@ name: Publish & Verify AOT Compatibility
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-verify-aot-compat: