ci: add job-level permissions for least-privilege security

Add explicit permissions blocks to every job in ci-orchestrator.yml,
build_all_targets.yml, and ekf_update_change_indicator.yml. Each job
now declares only the minimum GITHUB_TOKEN scopes it needs, satisfying
github-advanced-security CodeQL findings. Remove unused issues:write
from ci-orchestrator top-level permissions.

Signed-off-by: Ramon Roche <mrpollo@gmail.com>

Author: mrpollo

.github/workflows/build_all_targets.yml

@@ -42,6 +42,9 @@ jobs:
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
     # runs-on: ubuntu-latest
     runs-on: [runs-on,runner=1cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
+      actions: read
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
       timestamp: ${{ steps.set-timestamp.outputs.timestamp }}
@@ -99,6 +102,9 @@ jobs:
     # runs-on: ubuntu-latest
     runs-on: [runs-on,"runner=8cpu-linux-${{ matrix.runner }}","image=ubuntu24-full-${{ matrix.runner }}","run-id=${{ github.run_id }}",spot=false]
     needs: group_targets
+    permissions:
+      contents: read
+      packages: read
     strategy:
       matrix: ${{ fromJson(needs.group_targets.outputs.matrix) }}
       fail-fast: false
@@ -179,6 +185,8 @@ jobs:
     runs-on: [runs-on,runner=1cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
     needs: [setup, group_targets]
     if: startsWith(github.ref, 'refs/tags/v') || contains(fromJSON('["main","stable","beta"]'), needs.group_targets.outputs.branchname)
+    permissions:
+      contents: write
     outputs:
       uploadlocation: ${{ steps.upload-location.outputs.uploadlocation }}
     steps:

.github/workflows/ci-orchestrator.yml

@@ -23,7 +23,6 @@ permissions:
   contents: read
   packages: read
   pull-requests: write
-  issues: write
 
 env:
   MIN_FLASH_POS_DIFF_FOR_COMMENT: 50
@@ -39,6 +38,9 @@ jobs:
   gate-checks:
     name: Gate Checks [${{ matrix.check }}]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     container:
       image: ghcr.io/px4/px4-dev:v1.16.0
     strategy:
@@ -62,6 +64,9 @@ jobs:
   shellcheck:
     name: Shellcheck
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: read
     container:
       image: ghcr.io/px4/px4-dev:v1.16.0
     steps:
@@ -108,6 +113,8 @@ jobs:
   mavsdk-python-checks:
     name: MAVSDK Python [${{ matrix.check }}]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: true
       matrix:
@@ -143,6 +150,8 @@ jobs:
     name: Build px4_sitl_default (for cache)
     needs: [gate-checks, shellcheck, mavsdk-python-checks]
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     container:
       image: px4io/px4-dev:v1.16.0
     steps:
@@ -194,6 +203,8 @@ jobs:
     name: Basic Tests [${{ matrix.check }}]
     needs: [gate-checks, shellcheck, mavsdk-python-checks, build-sitl]
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     container:
       image: px4io/px4-dev:v1.16.0
     strategy:
@@ -300,6 +311,8 @@ jobs:
     needs: [gate-checks, shellcheck, mavsdk-python-checks]
     if: github.event_name == 'pull_request'
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     container:
       image: px4io/px4-dev:v1.16.0
     steps:
@@ -353,6 +366,8 @@ jobs:
     needs: [basic-tests, ekf-functional-check]
     if: always() && needs.basic-tests.result == 'success' && (needs.ekf-functional-check.result == 'success' || needs.ekf-functional-check.result == 'skipped')
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -413,6 +428,8 @@ jobs:
     needs: [basic-tests, ekf-functional-check]
     if: always() && needs.basic-tests.result == 'success' && (needs.ekf-functional-check.result == 'success' || needs.ekf-functional-check.result == 'skipped')
     runs-on: macos-latest
+    permissions:
+      contents: read
     steps:
       - name: Install Python 3.10
         uses: actions/setup-python@v5
@@ -491,6 +508,8 @@ jobs:
     needs: [basic-tests, ekf-functional-check]
     if: always() && needs.basic-tests.result == 'success' && (needs.ekf-functional-check.result == 'success' || needs.ekf-functional-check.result == 'skipped')
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -545,6 +564,8 @@ jobs:
     needs: [basic-tests, ekf-functional-check]
     if: always() && needs.basic-tests.result == 'success' && (needs.ekf-functional-check.result == 'success' || needs.ekf-functional-check.result == 'skipped')
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -619,6 +640,8 @@ jobs:
     name: Publish Flash Analysis Results
     runs-on: [runs-on,runner=1cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}"]
     needs: [flash-analysis]
+    permissions:
+      pull-requests: write
     env:
       V5X-SUMMARY-MAP-ABS: ${{ fromJSON(fromJSON(needs.flash-analysis.outputs.px4_fmu-v5x-bloaty-summary-map).vm-absolute) }}
       V5X-SUMMARY-MAP-PERC: ${{ fromJSON(fromJSON(needs.flash-analysis.outputs.px4_fmu-v5x-bloaty-summary-map).vm-percentage) }}
@@ -678,6 +701,8 @@ jobs:
     needs: [basic-tests, ekf-functional-check]
     if: always() && needs.basic-tests.result == 'success' && (needs.ekf-functional-check.result == 'success' || needs.ekf-functional-check.result == 'skipped')
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     container:
       image: px4io/px4-dev:v1.16.0
     steps:
@@ -720,6 +745,8 @@ jobs:
     needs: [ubuntu-builds, macos-build, itcm-check, flash-analysis, failsafe-sim]
     if: always() && needs.ubuntu-builds.result == 'success' && needs.macos-build.result == 'success' && needs.itcm-check.result == 'success' && needs.flash-analysis.result == 'success'
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu22-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     container:
       image: px4io/px4-dev-simulation-focal:2021-09-08
       options: --privileged --ulimit core=-1 --security-opt seccomp=unconfined
@@ -829,6 +856,8 @@ jobs:
     needs: [ubuntu-builds, macos-build, itcm-check, flash-analysis, failsafe-sim]
     if: always() && needs.ubuntu-builds.result == 'success' && needs.macos-build.result == 'success' && needs.itcm-check.result == 'success' && needs.flash-analysis.result == 'success'
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu22-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     container:
       image: px4io/px4-dev-ros2-galactic:2021-09-08
       options: --privileged --ulimit core=-1 --security-opt seccomp=unconfined
@@ -960,6 +989,8 @@ jobs:
     needs: [ubuntu-builds, macos-build, itcm-check, flash-analysis, failsafe-sim]
     if: always() && needs.ubuntu-builds.result == 'success' && needs.macos-build.result == 'success' && needs.itcm-check.result == 'success' && needs.flash-analysis.result == 'success'
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu22-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -996,6 +1027,8 @@ jobs:
     needs: [ubuntu-builds, macos-build, itcm-check, flash-analysis, failsafe-sim]
     if: always() && needs.ubuntu-builds.result == 'success' && needs.macos-build.result == 'success' && needs.itcm-check.result == 'success' && needs.flash-analysis.result == 'success'
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -1058,6 +1091,7 @@ jobs:
     needs: [gate-checks, shellcheck, mavsdk-python-checks, build-sitl, basic-tests, ekf-functional-check, ubuntu-builds, macos-build, itcm-check, flash-analysis, failsafe-sim, sitl-tests, ros-integration-tests, mavros-tests, ros-translation-node]
     if: always()
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Generate CI Summary
         if: always()

.github/workflows/ekf_update_change_indicator.yml

@@ -5,9 +5,14 @@ on:
     paths-ignore:
       - 'docs/**'
 
+permissions:
+  contents: write
+
 jobs:
   unit_tests:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     env:
       GIT_COMMITTER_EMAIL: bot@px4.io
       GIT_COMMITTER_NAME: PX4BuildBot