Merge branch 'main' into add-missing-permissions

Author: emdneto

.github/scripts/use-cla-approved-github-bot.sh

@@ -1,4 +1,4 @@
 #!/bin/bash -e
 
-git config user.name opentelemetrybot
-git config user.email 107717825+opentelemetrybot@users.noreply.github.com
+git config user.name otelbot
+git config user.email 197425009+otelbot@users.noreply.github.com

.github/workflows/backport.yml

@@ -6,8 +6,14 @@ on:
         description: "The pull request # to backport"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   backport:
+    permissions:
+      contents: write # required for pushing branches
+      pull-requests: write # required for creating pull requests
     runs-on: ubuntu-latest
     permissions:
       contents: write # required for pushing changes
@@ -26,16 +32,22 @@ jobs:
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-github-bot.sh
 
+      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        id: otelbot-token
+        with:
+          app-id: ${{ vars.OTELBOT_APP_ID }}
+          private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+
       - name: Create pull request
         env:
           NUMBER: ${{ github.event.inputs.number }}
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ secrets.OPENTELEMETRYBOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
           title=$(gh pr view $NUMBER --json title --jq .title)
 
-          branch="opentelemetrybot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
+          branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
           git cherry-pick $commit
           git push origin HEAD:$branch

.github/workflows/changelog.yml

@@ -10,12 +10,15 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   changelog:
     runs-on: ubuntu-latest
     if: |
       !contains(github.event.pull_request.labels.*.name, 'Skip Changelog')
-      && github.actor != 'opentelemetrybot'
+      && github.actor != 'otelbot[bot]'
 
     steps:
       - uses: actions/checkout@v4

.github/workflows/codeql-analysis.yml

@@ -14,8 +14,13 @@ on:
     #        *  * * * *
     - cron: '30 1 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   CodeQL-Build:
+    permissions:
+      security-events: write # for github/codeql-action/analyze to upload SARIF results
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/component-owners.yml

@@ -6,6 +6,9 @@ name: 'Component Owners'
 on:
   pull_request_target:
 
+permissions:
+  contents: read
+
 jobs:
   run_self:
     runs-on: ubuntu-latest

.github/workflows/core_contrib_test_0.yml

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 env:
   CORE_REPO_SHA: ${{ inputs.CORE_REPO_SHA }}
   CONTRIB_REPO_SHA: ${{ inputs.CONTRIB_REPO_SHA }}

.github/workflows/generate_workflows_lib/src/generate_workflows_lib/core_contrib_test.yml.j2

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 env:
   CORE_REPO_SHA: ${% raw %}{{ inputs.CORE_REPO_SHA }}{% endraw %}
   CONTRIB_REPO_SHA: ${% raw %}{{ inputs.CONTRIB_REPO_SHA }}{% endraw %}

.github/workflows/generate_workflows_lib/src/generate_workflows_lib/lint.yml.j2

@@ -9,6 +9,9 @@ on:
     - 'release/*'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${% raw %}{{ github.workflow }}-${{ github.head_ref || github.run_id }}{% endraw %}
   cancel-in-progress: true

.github/workflows/generate_workflows_lib/src/generate_workflows_lib/misc.yml.j2

@@ -9,6 +9,9 @@ on:
     - 'release/*'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${% raw %}{{ github.workflow }}-${{ github.head_ref || github.run_id }}{% endraw %}
   cancel-in-progress: true
@@ -36,16 +39,16 @@ jobs:
     {%- if job_data == "generate-workflows" %}
     if: |
       !contains(github.event.pull_request.labels.*.name, 'Skip generate-workflows')
-      && github.event.pull_request.user.login != 'opentelemetrybot' && github.event_name == 'pull_request'
+      && github.event.pull_request.user.login != 'otelbot[bot]' && github.event_name == 'pull_request'
     {%- endif %}
     {%- if job_data == "public-symbols-check" %}
     if: |
       !contains(github.event.pull_request.labels.*.name, 'Approve Public API check')
-      && github.actor != 'opentelemetrybot' && github.event_name == 'pull_request'
+      && github.actor != 'otelbot[bot]' && github.event_name == 'pull_request'
     {%- endif %}
     {%- if job_data == "docs" %}
     if: |
-      github.event.pull_request.user.login != 'opentelemetrybot' && github.event_name == 'pull_request'
+      github.event.pull_request.user.login != 'otelbot[bot]' && github.event_name == 'pull_request'
     {%- endif %}
     steps:
       - name: Checkout repo @ SHA - ${% raw %}{{ github.sha }}{% endraw %}

.github/workflows/generate_workflows_lib/src/generate_workflows_lib/test.yml.j2

@@ -9,6 +9,9 @@ on:
     - 'release/*'
   pull_request:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${% raw %}{{ github.workflow }}-${{ github.head_ref || github.run_id }}{% endraw %}
   cancel-in-progress: true