Merge pull request erlang#10999 from kikofernandez/kiko/fix-gh-actions-permissions

otp: fixes gh actions permissions

OTP-20093

Author: kikofernandez

.github/scorecard.yaml

@@ -29,6 +29,9 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   check-version-pinning:
     runs-on: 'ubuntu-latest'
@@ -43,4 +46,4 @@ jobs:
 
       - uses: 'docker://ghcr.io/sethvargo/ratchet:latest@sha256:527e78e6d29a9ac306e843cf766afe0604a0b35633f16913d85dd522218e8ca1' # ratchet:docker://ghcr.io/sethvargo/ratchet:latest
         with:
-          args: 'check ${{ steps.files.outputs.files }}'
+          args: 'check ${{ steps.files.outputs.files }}'

.github/workflows/github-actions-checker.yaml

@@ -56,7 +56,6 @@ env:
 permissions:
   contents: read
   pull-requests: read
-  security-events: write
 
 jobs:
 
@@ -530,6 +529,7 @@ jobs:
     if: ${{ needs.modified-vendor-files.outputs.vendor-files == 'true' && github.event_name == 'pull_request' && github.repository == 'erlang/otp'}}
     permissions:
       actions: read
+      contents: read
     name: Vendor Vulnerability Scanning
     uses: ./.github/workflows/reusable-vendor-vulnerability-scanner.yml
     with:
@@ -704,6 +704,9 @@ jobs:
     name: Run static analysis
     runs-on: ubuntu-latest
     needs: pack
+    permissions:
+      contents: read
+      security-events: write   # needed for SARIF upload
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./.github/actions/build-base-image

.github/workflows/main.yaml

@@ -35,10 +35,10 @@ jobs:
   run-scheduled-openvex-sync:
     runs-on: ubuntu-latest
     permissions:
-      security-events: read
-      actions: write
-      contents: write
-      pull-requests: write
+      security-events: read # use inside the otp-compliance.es as API call
+      actions: write        # use inside the otp-compliance.es
+      contents: write       # use inside the otp-compliance.es
+      pull-requests: write  # use inside the otp-compliance.es
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/openvex-sync.yml

@@ -30,7 +30,6 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   schedule-scan:

.github/workflows/ossf-compiler-flags-scanner.yaml

@@ -34,6 +34,8 @@ permissions:
 jobs:
   schedule-scan:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     if: github.event_name == 'schedule' && github.repository == 'erlang/otp'
     # if: github.event_name != 'workflow_dispatch' # used for testing
     outputs:

.github/workflows/osv-scanner-scheduled.yml

@@ -26,12 +26,14 @@ on:
       - '**/vendor.info'
 
 permissions:
-  contents: write   # Required to push commits
-  pull-requests: read
+  contents: read
 
 jobs:
   update-vendored-deps:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write   # Required to push commits
+      pull-requests: write
     if: >
       github.event_name == 'pull_request' &&
       contains(github.event.pull_request.title, 'update dependency') &&

.github/workflows/renovate-vendored-deps.yaml

@@ -85,6 +85,10 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read # needed for checkout
+  actions: read
+
 env:
   VERSION: ${{ inputs.version }}
 

.github/workflows/reusable-vendor-vulnerability-scanner.yml

@@ -29,7 +29,9 @@ on:
     branches:
       - master
 
-permissions: read-all
+permissions:
+  contents: read
+  actions: read
 
 jobs:
   analysis:
@@ -52,4 +54,3 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-          config_file: .github/scorecard.yaml

.github/workflows/scorecard.yaml

@@ -26,6 +26,9 @@ on:
   schedule:
     - cron: 0 9 25 10 *
 
+permissions:
+  contents: read
+
 jobs:
   review-security-practices:
     if: github.event_name == 'schedule' && github.repository == 'erlang/otp'