Revert "Remove (hopefully) unnecessary workflow lines" (open-telemetry#13247)

trask · web-flow · commit c03d5274f471 · 2025-02-07T12:09:32.000-08:00
diff --git a/.github/workflows/build-daily-no-build-cache.yml b/.github/workflows/build-daily-no-build-cache.yml
@@ -39,6 +39,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - common
diff --git a/.github/workflows/build-daily.yml b/.github/workflows/build-daily.yml
@@ -42,6 +42,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - common
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -22,6 +22,7 @@ permissions:
 jobs:
   analyze:
     permissions:
+      contents: read
       actions: read  # for github/codeql-action/init to get workflow details
       security-events: write  # for github/codeql-action/analyze to upload SARIF results
     runs-on: otel-linux-latest-8-cores
diff --git a/.github/workflows/issue-management-feedback-label.yml b/.github/workflows/issue-management-feedback-label.yml
@@ -10,6 +10,7 @@ permissions:
 jobs:
   issue_comment:
     permissions:
+      contents: read
       issues: write
     if: >
       contains(github.event.issue.labels.*.name, 'needs author feedback') &&
diff --git a/.github/workflows/issue-management-stale-action.yml b/.github/workflows/issue-management-stale-action.yml
@@ -11,6 +11,7 @@ permissions:
 jobs:
   stale:
     permissions:
+      contents: read
       issues: write  # for actions/stale to close stale issues
       pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
@@ -8,6 +8,7 @@ jobs:
   label:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write
     steps:
     - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
diff --git a/.github/workflows/native-tests-daily.yml b/.github/workflows/native-tests-daily.yml
@@ -17,6 +17,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - graalvm-native-tests
diff --git a/.github/workflows/overhead-benchmark-daily.yml b/.github/workflows/overhead-benchmark-daily.yml
@@ -56,6 +56,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - run-overhead-tests
diff --git a/.github/workflows/owasp-dependency-check-daily.yml b/.github/workflows/owasp-dependency-check-daily.yml
@@ -44,6 +44,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - analyze
diff --git a/.github/workflows/publish-petclinic-benchmark-image.yml b/.github/workflows/publish-petclinic-benchmark-image.yml
@@ -14,6 +14,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       packages: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/.github/workflows/publish-smoke-test-early-jdk8-images.yml b/.github/workflows/publish-smoke-test-early-jdk8-images.yml
@@ -15,6 +15,7 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     runs-on: ubuntu-latest
     steps:
@@ -47,6 +48,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish
diff --git a/.github/workflows/publish-smoke-test-fake-backend-images.yml b/.github/workflows/publish-smoke-test-fake-backend-images.yml
@@ -15,6 +15,7 @@ permissions:
 jobs:
   publishLinux:
     permissions:
+      contents: read
       packages: write
     runs-on: ubuntu-latest
     steps:
@@ -47,6 +48,7 @@ jobs:
 
   publishWindows:
     permissions:
+      contents: read
       packages: write
     runs-on: windows-latest
     defaults:
@@ -82,6 +84,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publishLinux
diff --git a/.github/workflows/publish-smoke-test-grpc-images.yml b/.github/workflows/publish-smoke-test-grpc-images.yml
@@ -15,13 +15,15 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
       project: ":smoke-tests:images:grpc"
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish
diff --git a/.github/workflows/publish-smoke-test-play-images.yml b/.github/workflows/publish-smoke-test-play-images.yml
@@ -15,13 +15,15 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
       project: ":smoke-tests:images:play"
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish
diff --git a/.github/workflows/publish-smoke-test-quarkus-images.yml b/.github/workflows/publish-smoke-test-quarkus-images.yml
@@ -15,6 +15,7 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
@@ -25,6 +26,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish
diff --git a/.github/workflows/publish-smoke-test-security-manager-images.yml b/.github/workflows/publish-smoke-test-security-manager-images.yml
@@ -15,13 +15,15 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
       project: ":smoke-tests:images:security-manager"
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish
diff --git a/.github/workflows/publish-smoke-test-servlet-images.yml b/.github/workflows/publish-smoke-test-servlet-images.yml
@@ -24,6 +24,7 @@ jobs:
 
   publish:
     permissions:
+      contents: read
       packages: write
     needs: prepare
     runs-on: ${{ matrix.os }}
@@ -87,6 +88,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish
diff --git a/.github/workflows/publish-smoke-test-spring-boot-images.yml b/.github/workflows/publish-smoke-test-spring-boot-images.yml
@@ -15,13 +15,15 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
       project: ":smoke-tests:images:spring-boot"
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish
diff --git a/.github/workflows/reusable-publish-smoke-test-images.yml b/.github/workflows/reusable-publish-smoke-test-images.yml
@@ -36,6 +36,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       packages: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
diff --git a/.github/workflows/reusable-workflow-notification.yml b/.github/workflows/reusable-workflow-notification.yml
@@ -15,6 +15,7 @@ permissions:
 jobs:
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     runs-on: ubuntu-latest
     steps:
