Add minimum token permissions for all github workflow files (#526)

Co-authored-by: otelbot <[email protected]>

Author: opentelemetrybot

.github/workflows/elixir.yml

@@ -10,6 +10,9 @@ on:
     branches:
       - "main"
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.head_ref || github.run_id }}-elixir
   cancel-in-progress: true

.github/workflows/erlang.yml

@@ -10,6 +10,9 @@ on:
     branches:
       - "main"
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.head_ref || github.run_id }}-erlang
   cancel-in-progress: true

.github/workflows/labeler.yml

@@ -1,8 +1,13 @@
 name: "Pull Request Labeler"
 on: [pull_request_target]
 
+permissions:
+  contents: read
+
 jobs:
   triage:
+    permissions:
+      pull-requests: write # required for labeling pull requests
     runs-on: ubuntu-24.04
     steps:
     - uses: actions/labeler@v4

.github/workflows/publish-mix-hex-release.yml

@@ -49,6 +49,9 @@ on:
           - prep
           - publish
 
+permissions:
+  contents: read
+
 jobs:
   config:
     runs-on: ubuntu-latest

.github/workflows/release-drafter.yml

@@ -6,8 +6,13 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   opentelemetry-aws-xray-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-aws-xray-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -18,6 +23,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-broadway-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-broadway-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -28,6 +35,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-cowboy-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-cowboy-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -38,6 +47,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-dataloader-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-dataloader-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -48,6 +59,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-ecto-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-ecto-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -58,6 +71,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-elli-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-elli-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -68,6 +83,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-finch-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-finch-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -78,6 +95,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-grpcbox-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-grpcbox-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -88,6 +107,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-httpoison-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-httpoison-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -98,6 +119,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-nebulex-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-nebulex-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -108,6 +131,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-oban-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-oban-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -118,6 +143,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-phoenix-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-phoenix-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -128,6 +155,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-bandit-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-bandit-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -138,6 +167,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-process-propagator-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-process-propagator-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -148,6 +179,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-redix-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-redix-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -158,6 +191,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-req-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-req-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -168,6 +203,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-telemetry-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-telemetry-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -178,6 +215,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-tesla-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-tesla-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -188,6 +227,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-xandra-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-xandra-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -198,6 +239,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   otel-http-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[otel-http-release] Draft release'
     runs-on: ubuntu-24.04
     steps:
@@ -208,6 +251,8 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   opentelemetry-commanded-release:
+    permissions:
+      contents: write # required for creating draft releases
     name: '[opentelemetry-commanded-release] Draft release'
     runs-on: ubuntu-24.04
     steps: