Merge pull request #11064 from kikofernandez/kiko/otp/release-gh-action-backup-continuation/OTP-20040

otp: fixes permissions for reusable workflows

OTP-20040

Author: kikofernandez

.github/workflows/main.yaml

@@ -60,6 +60,8 @@ permissions:
 jobs:
   check-files:
     if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
     uses: ./.github/workflows/reusable-check-files.yaml
     with:
       pr_base_sha:  ${{ github.event.pull_request.base.sha }}
@@ -75,9 +77,10 @@ jobs:
   pack:
     name: Build Erlang/OTP (64-bit)
     needs: setup
-    uses: ./.github/workflows/reusable-pack.yaml
     permissions:
       contents: read
+      actions: write
+    uses: ./.github/workflows/reusable-pack.yaml
     with:
       base_branch:          ${{ needs.setup.outputs.base_branch }}
       full_build_and_check: ${{ needs.setup.outputs.full_build_and_check }}
@@ -86,6 +89,9 @@ jobs:
   build-macos:
     name: Build Erlang/OTP (macOS)
     needs: pack
+    permissions:
+      contents: read
+      actions:  write
     if: needs.pack.outputs.build-c-code == 'true'
     uses: ./.github/workflows/reusable-build-macos.yaml
     with:
@@ -95,6 +101,9 @@ jobs:
     name: Build Erlang/OTP (iOS)
     needs: pack
     if: needs.pack.outputs.build-c-code == 'true'
+    permissions:
+      contents: read
+      actions: write
     uses: ./.github/workflows/reusable-build-ios.yaml
     with:
       base_branch: ${{ needs.pack.outputs.base_branch }}
@@ -103,6 +112,9 @@ jobs:
     name: Build Erlang/OTP (Windows)
     needs: pack
     if: needs.pack.outputs.build-c-code == 'true'
+    permissions:
+      contents: read
+      actions:  write
     uses: ./.github/workflows/reusable-build-windows.yaml
     with:
       base_branch: ${{ needs.pack.outputs.base_branch }}
@@ -111,6 +123,8 @@ jobs:
     name: Build Erlang/OTP (Types and Flavors)
     needs: pack
     if: needs.pack.outputs.build-c-code == 'true'
+    permissions:
+      contents: read
     uses: ./.github/workflows/reusable-build-flavours.yaml
     with:
       base_branch: ${{ needs.pack.outputs.base_branch }}
@@ -121,8 +135,9 @@ jobs:
     needs: pack
     if: ${{ github.event_name == 'pull_request' && github.repository == 'erlang/otp'}}
     permissions:
-      actions: read
       contents: read
+      actions: write
+      issues: write
     name: Vendor Vulnerability Scanning
     # This is an internal and trusted workflow.
     uses: ./.github/workflows/reusable-vendor-vulnerability-scanner.yml # zizmor: ignore[secrets-inherit]
@@ -140,6 +155,8 @@ jobs:
     name: Build Erlang/OTP
     needs: pack
     if: needs.pack.outputs.build-c-code == 'true'
+    permissions:
+      contents: read
     uses: ./.github/workflows/reusable-build-otp.yaml
     with:
       base_branch: ${{ needs.pack.outputs.base_branch }}
@@ -149,6 +166,7 @@ jobs:
     needs: pack
     permissions:
       contents: read
+      actions: read
     if: needs.pack.outputs.build-c-code == 'true'
     uses: ./.github/workflows/reusable-freebsd.yaml
     with:
@@ -160,6 +178,7 @@ jobs:
     if: needs.pack.outputs.build-c-code == 'true'
     permissions:
       contents: read
+      actions: read
     uses: ./.github/workflows/reusable-openbsd.yaml
     with:
       base_branch: ${{ needs.pack.outputs.base_branch }}
@@ -170,6 +189,7 @@ jobs:
     if: needs.pack.outputs.build-c-code == 'true' && false # Temporarily disable Solaris build as the VM image is currently broken
     permissions:
       contents: read
+      actions: read
     uses: ./.github/workflows/reusable-solaris.yaml
     with:
       base_branch: ${{ needs.pack.outputs.base_branch }}
@@ -179,6 +199,9 @@ jobs:
     needs:
       - setup
       - pack
+    permissions:
+      contents: read
+      actions:  write
     uses: ./.github/workflows/reusable-documentation.yaml
     secrets:
       TRIGGER_ERLANG_ORG_BUILD: ${{ secrets.TRIGGER_ERLANG_ORG_BUILD }}
@@ -203,6 +226,9 @@ jobs:
     name: Test Erlang/OTP
     needs: pack
     if: needs.pack.outputs.changes != '[]'
+    permissions:
+      contents: read
+      actions:  write
     uses: ./.github/workflows/reusable-test.yaml
     with:
       changes:     ${{ needs.pack.outputs.changes }}
@@ -211,6 +237,9 @@ jobs:
   system-test:
     name: Test Erlang/OTP (system)
     if: ${{ !cancelled() && needs.pack.result == 'success' }} # Run even if the need has failed
+    permissions:
+      contents: read
+      actions:  write
     needs:
       - pack
       - test
@@ -237,7 +266,7 @@ jobs:
     uses: ./.github/workflows/reusable-sbom.yaml
     permissions:
       contents: write
-      actions:  read
+      actions:  write
       packages: read
       id-token: write
     with:
@@ -257,6 +286,7 @@ jobs:
       contents:     write
       attestations: write
       id-token:     write
+      actions:      write
     if: startsWith(github.ref, 'refs/tags/OTP-') && github.repository == 'erlang/otp'
     uses: ./.github/workflows/reusable-release.yaml
     with:

.github/workflows/reusable-build-flavours.yaml

@@ -41,6 +41,8 @@ jobs:
   build-flavors:
     name: Build Erlang/OTP (Types and Flavors)
     runs-on: ubuntu-latest
+    permissions:
+      contents: read   # actions/checkout + ./.github/actions/build-base-image
     strategy:
       matrix:
         flavor: [jit, emu]

.github/workflows/reusable-build-ios.yaml

@@ -28,6 +28,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 # NOTE: This job should only be executed on the callee with `needs: pack`
 jobs:
   build-ios:
@@ -36,6 +39,9 @@ jobs:
       TARGET_ARCH: aarch64-apple-ios
     name: Build Erlang/OTP (iOS)
     runs-on: macos-15
+    permissions:
+      contents: read   # actions/checkout
+      actions: write   # actions/upload-artifact
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
         with:

.github/workflows/reusable-build-macos.yaml

@@ -36,6 +36,9 @@ jobs:
   build-macos:
     name: Build Erlang/OTP (macOS)
     runs-on: macos-15
+    permissions:
+      contents: read   # actions/checkout + actions/cache (restore/save)
+      actions: write   # actions/download-artifact + actions/upload-artifact
     env:
       WXWIDGETS_VERSION: 3.2.9
       MACOS_VERSION: 15

.github/workflows/reusable-build-otp.yaml

@@ -35,6 +35,8 @@ jobs:
   build:
     name: Build Erlang/OTP
     runs-on: ubuntu-latest
+    permissions:
+      contents: read   # actions/checkout + ./.github/actions/build-base-image
     strategy:
       matrix:
         type: [32-bit,cross-compile,clang]

.github/workflows/reusable-build-windows.yaml

@@ -28,6 +28,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 # NOTE: This job should only be executed on the callee with `needs: pack`
 jobs:
   build-windows:
@@ -38,6 +41,9 @@ jobs:
       WXWIDGETS_VERSION: 3.2.6
     name: Build Erlang/OTP (Windows)
     runs-on: windows-2025
+    permissions:
+      contents: read   # actions/cache (restore/save wxWidgets cache)
+      actions:  write  # actions/download-artifact + actions/upload-artifact
     steps:
       - uses: Vampire/setup-wsl@6a8db447be7ed35f2f499c02c6e60ff77ef11278 # ratchet:Vampire/setup-wsl@v6.0.0
         with:

.github/workflows/reusable-check-files.yaml

@@ -52,6 +52,8 @@ jobs:
   check-files:
     name: Check modified files for errors
     runs-on: ubuntu-latest
+    permissions:
+      contents: read   # actions/checkout (fetch-depth: 0) + git diff (whitespace + BEAM detection)
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
         with:

.github/workflows/reusable-documentation.yaml

@@ -39,11 +39,16 @@ on:
       TRIGGER_ERLANG_ORG_BUILD:
         required: true
 
+permissions:
+  contents: read
 
 jobs:
   documentation:
     name: Build and check documentation
     runs-on: ubuntu-latest
+    permissions:
+      contents: read   # actions/checkout + ./.github/actions/build-base-image
+      actions:  write  # actions/upload-artifact
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
         with:

.github/workflows/reusable-freebsd.yaml

@@ -36,6 +36,8 @@ jobs:
   freebsd:
     name: Build Erlang/OTP (FreeBSD)
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
     steps:
       - name: Download source archive
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0

.github/workflows/reusable-openbsd.yaml

@@ -36,6 +36,8 @@ jobs:
   openbsd:
     name: Build Erlang/OTP (OpenBSD)
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
     steps:
       - name: Download source archive
         uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0