Add minimum token permissions for all github workflow files (#4155)

Co-authored-by: otelbot <197425009+otelbot@users.noreply.github.com>
Co-authored-by: Mikołaj Świątek <mail+sumo@mikolajswiatek.com>

Author: 3 people

.github/workflows/continuous-integration.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true

.github/workflows/e2e-junit-report.yml

@@ -10,12 +10,14 @@ on:
         required: true
 
 permissions:
-  checks: write
-  pull-requests: write
-  actions: read
+  contents: read
 
 jobs:
   report:
+    permissions:
+      checks: write
+      pull-requests: write
+      actions: read
     runs-on: ubuntu-latest
     steps:
       - name: Download Test Report

.github/workflows/publish-autoinstrumentation-apache-httpd.yaml

@@ -19,12 +19,13 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      packages: write
+      attestations: write
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/publish-autoinstrumentation-dotnet.yaml

@@ -19,12 +19,13 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      packages: write
+      attestations: write
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/publish-autoinstrumentation-java.yaml

@@ -19,12 +19,13 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      packages: write
+      attestations: write
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/publish-autoinstrumentation-nodejs.yaml

@@ -19,12 +19,13 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      packages: write
+      attestations: write
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/publish-autoinstrumentation-php.yaml

@@ -19,12 +19,13 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      packages: write
+      attestations: write
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/publish-autoinstrumentation-python.yaml

@@ -19,12 +19,13 @@ concurrency:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      packages: write
+      attestations: write
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/publish-images.yaml

@@ -12,12 +12,13 @@ env:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      packages: write
+      attestations: write
+      id-token: write
     name: Publish container images
     runs-on: ubuntu-latest
     steps:

.github/workflows/publish-must-gather.yaml

@@ -12,12 +12,13 @@ env:
 
 permissions:
   contents: read
-  packages: write
-  attestations: write
-  id-token: write
 
 jobs:
   publish:
+    permissions:
+      packages: write
+      attestations: write
+      id-token: write
     name: Publish must-gather container image
     runs-on: ubuntu-latest
     steps: