ci: add GitHub token permissions for workflows

[varunsh-coder]

This PR adds minimum token permissions for the GITHUB_TOKEN using https://github.com/step-security/secure-workflows.

GitHub recommends defining minimum GITHUB_TOKEN permissions for securing GitHub Actions workflows

• https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
• https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
• The Open Source Security Foundation (OpenSSF) Scorecards treats not setting token permissions as a high-risk issue

This project is part of the top 100 critical projects as per OpenSSF (https://github.com/ossf/wg-securing-critical-projects), so fixing the token permissions to improve security.

Signed-off-by: Varun Sharma [email protected]

• closes #xxxx (Replace xxxx with the Github issue number)
• Tests added and passed if fixing a bug or adding a new feature
• All code checks passed.
• Added type annotations to new arguments/methods/functions.
• Added an entry in the latest doc/source/whatsnew/vX.X.X.rst file if fixing a bug or adding a new feature.

[mroeschke]

If we set Read repository contents permission in our repository settings, would we then only need to specify the write permissions when needed?

[phofl]

We are not closing the prs, the not only adds a label stale

[varunsh-coder]

Hi @phofl, is your ask to remove or change the comment? Just wanted to confirm before making the change.

I can remove the comment or change it to to label stale PRs.

Also, looks like this workflow does not update stale issues. If that is the case, I can remove the issues: write permission.

[mroeschke]

This action only adds a stale label and writes one comment to a PR, so whatever permission are needed to perform those actions can be set.

[varunsh-coder]

Updated stale-pr.yml. Removed issues: write since issues are not being updated based on the config. Also removed the comment for pull-requests: write.

[varunsh-coder]

If we set Read repository contents permission in our repository settings, would we then only need to specify the write permissions when needed?

Hi @mroeschke yes, that is true. At the same time, it is a best practice to set the permissions in the workflow files explicitly.

• The permissions are encapsulated with the workflow file, so easier to review and version (same reason applies for other as-code files)
• If someone forks the repo, the repository settings are not copied over, so the workflow in the forked repo is not secure. Whereas if the workflow file has explicit permissions, the settings are copied over.

So, setting Read repository contents permission in the repo setting is a good idea as future workflows in the repo will be secure-by-default. In addition, I would also recommend setting permissions explicitly in the workflow files.

[mroeschke]

Thanks for the explanation. Agreed to make these explicit in the the yaml files then

[mroeschke]

Thanks @varunsh-coder