[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign yanniszark for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

@pnacht thanks for this!

We should confirm that the repo is not already set to use "read" permission by default, which would make this redundant.

/cc @kimwnasptd

Hey @thesuperzapper, sorry for the late reply.

Looking at your Action logs, we can see the workflows are running with write-all permissions: https://github.com/kubeflow/kubeflow/actions/runs/6500263891/job/17655300160#step:1:19

While setting default read-only tokens is certainly what I'd recommend, I'd suggest also adding these explicit permissions to the workflows for added transparency to your users.

Hey @thesuperzapper & @kimwnasptd, let me know if this is something you'd be interested in.

I'll happily handle the conflicts if so.

@pnacht we could possibly do the other way around (change the repo to "read only" by default, and "inclusive" specify permissions that are needed beyond read in each job).

@james-jwu @zijianjoy can make the change, but we need to make the PR give appropriate permissions to each job first l.

@pnacht if you want to check which jobs need more than "read only", we can update the PR to give "write" access, and then update the repo settings.

Hey @thesuperzapper, I've just pushed a new commit that adds the minimal permissions needed for all workflows.

The only ones that need any write permission are the example_notebook_servers_publish.yml and ..._TEMPLATE.yml workflows, which need packages: write to push to the GitHub Container Repository.

Everything else should work fine with read-only tokens.

I've still left all workflows declaring permissions: contents: read at the top-level. This will be "redundant" if you modify the default token to read-only, but is still useful to let users know the workflows are adequately permissioned. These top-level permissions also serve as a backstop in case anyone accidentally changes the setting back to write-all (which many Actions unfortunately suggest doing instead of stating which permissions they actually need).

That being said, let me know if you'd rather I drop the top-level read-only permissions and leave that to the repo settings.

@andreyvelich: Closed this PR.