Update security pipeline and permissions (infra)

.github/workflows/black.yml

@@ -1,5 +1,6 @@
 name: Check formatting with Black
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/checkbox-beta-release.yml

@@ -1,6 +1,8 @@
 name: Beta version of checkbox
 run-name: Promote edge versions of checkbox to beta
-
+permissions:
+  contents: read
+  actions: read # used by can_promote_edge.py to query past daily builds
 on:
   push:
     branches:

.github/workflows/checkbox-ce-oem-daily-build.yml

@@ -1,5 +1,7 @@
 name: checkbox-ce-oem daily builds
-
+permissions:
+  contents: read
+  actions: read # used by gh api
 on:
   schedule:
     - cron: '00 21 * * *'
@@ -41,4 +43,6 @@ jobs:
     needs: check_for_commits
     if: ${{ needs.check_for_commits.outputs.new_commit_count > 0 || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/checkbox-ce-oem-edge-builds.yml
-    secrets: inherit
+    secrets:
+      SNAPCRAFT7_CREDS: ${{ secrets.SNAPCRAFT7_CREDS }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/checkbox-ce-oem-edge-builds.yml

@@ -1,8 +1,14 @@
 name: checkbox-ce-oem snap edge build
-
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   workflow_call:
+    secrets:
+      SNAPCRAFT7_CREDS:
+        required: true
+      GITHUB_TOKEN:
+        required: true
 
 jobs:
   snap:

.github/workflows/checkbox-daily-cross-builds.yaml

@@ -1,5 +1,6 @@
 name: Checkbox Snap daily cross-builds
-
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:
@@ -15,7 +16,11 @@ on:
         default: false
         required: false
         type: boolean
-
+    secrets:
+      SNAPCRAFT7_CREDS:
+        required: true
+      GITHUB_TOKEN:
+        required: true
 jobs:
   snap-runtime:
     strategy:

.github/workflows/checkbox-daily-native-builds.yaml

@@ -1,5 +1,6 @@
 name: Checkbox Snap daily native builds
-
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:
@@ -15,6 +16,11 @@ on:
         default: false
         required: false
         type: boolean
+    secrets:
+      SNAPCRAFT7_CREDS:
+        required: true
+      GITHUB_TOKEN:
+        required: true
 
 jobs:
   snap_runtime_native:

.github/workflows/checkbox-promote-beta-to-candidate.yml

@@ -1,6 +1,8 @@
 name: Promote Checkbox beta to candidate
 on:
     workflow_dispatch:
+permissions:
+  contents: read
 
 jobs:
   checkbox-promotion-beta-to-candidate-test:

.github/workflows/checkbox-stable-release.yml

@@ -1,5 +1,7 @@
 name: Stable version of checkbox
 run-name: Promote beta versions of checkbox to stable
+permissions:
+  contents: read # write used to create the release
 
 on:
   workflow_dispatch:
@@ -18,6 +20,8 @@ jobs:
         - jammy
         - large
         - X64
+    permissions:
+      contents: write
     steps:
       - name: Checkout checkbox monorepo
         uses: actions/checkout@v4

.github/workflows/checkbox-tics.yml

@@ -1,10 +1,8 @@
 name: TICS Code Quality Analysis
-
 on:
   schedule:
     - cron: '00 19 * * *'
   workflow_dispatch:
-
 permissions:
   contents: read
 

.github/workflows/daily-builds.yml

@@ -1,5 +1,7 @@
 name: Daily builds
-
+permissions:
+  contents: read
+  actions: read # used by gh api
 on:
   schedule:
     - cron: '00 18 * * *'
@@ -41,20 +43,26 @@ jobs:
     needs: check_for_commits
     if: ${{ needs.check_for_commits.outputs.new_commit_count > 0 || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/checkbox-daily-cross-builds.yaml
-    secrets: inherit
+    secrets:
+      SNAPCRAFT7_CREDS: ${{ secrets.SNAPCRAFT7_CREDS }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     with:
       store_upload: true
 
   snap-native-build-upload-daily:
     needs: check_for_commits
     if: ${{ needs.check_for_commits.outputs.new_commit_count > 0 || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/checkbox-daily-native-builds.yaml
-    secrets: inherit
+    secrets:
+      SNAPCRAFT7_CREDS: ${{ secrets.SNAPCRAFT7_CREDS }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     with:
       store_upload: true
 
   deb-daily:
     needs: check_for_commits
     if: ${{ needs.check_for_commits.outputs.new_commit_count > 0 || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/deb-daily-builds.yml
-    secrets: inherit
+    secrets:
+      LP_CREDS: ${{ secrets.LP_CREDS }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/deb-daily-builds.yml

@@ -1,9 +1,14 @@
 name: Debian packages daily build
-
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   workflow_call:
-
+    secrets:
+      LP_CREDS:
+        required: true
+      GITHUB_TOKEN:
+        required: true
 jobs:
   ppa_update:
     name: Sync PPA history with monorepo

.github/workflows/deb-sanity-builds.yml

@@ -1,5 +1,6 @@
 name: Sanity Debian package build
-
+permissions:
+  contents: read
 on:
   schedule:
     - cron: '00 14 * * *'

.github/workflows/deb_validator.yaml

@@ -1,5 +1,8 @@
 name: Verify debian packages
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main ]

.github/workflows/dispatch_lab_job.yaml

@@ -1,4 +1,6 @@
 name: Dispatch Checkbox jobs in the lab
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:

.github/workflows/documentation-check.yml

@@ -1,5 +1,6 @@
 name: Automatic documentation checks
-
+permissions:
+  contents: read
 on:
   pull_request:
     paths:

.github/workflows/label-cert-blocker-issue.yaml

@@ -1,5 +1,4 @@
 name: Label issue related to cert-blocker test cases
-
 on:
   issues:
     types: [opened]

.github/workflows/metabox.yaml

@@ -1,5 +1,8 @@
 name: Run Metabox when PR is approved
 
+permissions:
+  contents: read
+
 on:
   pull_request_review:
     types: [submitted]

.github/workflows/pr_validation.yaml

@@ -1,10 +1,13 @@
 name: PR Validation
+permissions:
+  contents: read
 on:
   pull_request:
     types:
       - opened
       - synchronize
       - edited
+
 jobs:
   validate_title:
     runs-on: ubuntu-latest

.github/workflows/testflinger-contrib-dss-regression.yaml

@@ -1,4 +1,6 @@
 name: Data Science Stack (DSS) Regression Testing
+permissions:
+  contents: read
 on:
   workflow_dispatch:
   # schedule:

.github/workflows/tox-checkbox-ng.yaml

@@ -1,5 +1,6 @@
 name: Test checkbox-ng with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-checkbox-support.yaml

@@ -1,5 +1,6 @@
 name: Test checkbox-support with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-contrib-pc-sanity.yaml

@@ -1,5 +1,6 @@
 name: Test pc-sanity (from contrib area) with tox
-
+permissions:
+  contents: read
 on:
   workflow_dispatch:
 

.github/workflows/tox-contrib-provider-ce-oem.yaml

@@ -1,5 +1,6 @@
 name: Test provider-ce-oem (from contrib area) with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-contrib-provider-dss.yaml

@@ -1,5 +1,6 @@
 name: Test checkbox-provider-dss (from contrib area) with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-base.yaml

@@ -1,5 +1,6 @@
 name: Test provider-base with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-certification-client.yaml

@@ -1,5 +1,6 @@
 name: Test provider-certification-client with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-certification-server.yaml

@@ -1,5 +1,6 @@
 name: Test provider-certification-server with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-docker.yaml

@@ -1,5 +1,6 @@
 name: Test provider-docker with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-genio.yaml

@@ -1,5 +1,6 @@
 name: Test provider-genio with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-gpgpu.yaml

@@ -1,5 +1,6 @@
 name: Test provider-gpgpu with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-iiotg.yaml

@@ -1,5 +1,6 @@
 name: Test Intel IOTG provider with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-resource.yaml

@@ -1,5 +1,6 @@
 name: Test provider-resource with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-sru.yaml

@@ -1,5 +1,6 @@
 name: Test provider-sru with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-tpm2.yaml

@@ -1,5 +1,6 @@
 name: Test provider-tpm2 with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-provider-tutorial.yaml

@@ -1,5 +1,6 @@
 name: Test provider-tutorial with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]

.github/workflows/tox-tools-release.yaml

@@ -1,5 +1,6 @@
 name: Test release tools with tox
-
+permissions:
+  contents: read
 on:
   push:
     branches: [ main ]