WEBUI-2017 WEBUI-2018 : define permissions at job level in workflow files (#3155)

Author: madhurkulshrestha-hyland

.github/workflows/a11y.yaml

@@ -20,15 +20,14 @@ on:
       REPOSITORY_MANAGER_PASSWORD:
         required: true
 
-permissions:
-  contents: read
-
 env:
   NPM_REPOSITORY: https://packages.nuxeo.com/repository/npm-public/
 
 jobs:
   a11y:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Debug

.github/workflows/catalog.yaml

@@ -25,17 +25,16 @@ on:
   release:
     types: [published]
 
-permissions:
-  contents: write
-  pull-requests: write
-
 env:
   ARTIFACT_ID: view-designer-catalog
   GROUP_ID: org.nuxeo.web.ui.studio
 
 jobs:
   catalog:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     if: |
       github.event_name != 'release' ||
       startsWith(github.event.release.tag_name, 'v3.1.')

.github/workflows/clean.yaml

@@ -22,13 +22,12 @@ env:
   GKE_CLUSTER: jx-prod
   GKE_ZONE: us-east1-b
 
-permissions:
-  contents: read
-
 jobs:
   id:
     name: Remote Caller ID ${{ github.event.inputs.caller_id }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Show caller id
         run: echo "run identifier ${{ github.event.inputs.caller_id }}"
@@ -41,6 +40,8 @@ jobs:
       contains(github.event.pull_request.labels.*.name, 'preview') ||
       github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Prepare environment (pull_request)

.github/workflows/cross-repo.yaml

@@ -46,9 +46,6 @@ on:
         type: string
         required: false
 
-permissions:
-  contents: read
-
 env:
   REFERENCE_BRANCH: maintenance-3.1.x
   NPM_REPOSITORY: https://packages.nuxeo.com/repository/npm-public/
@@ -57,6 +54,8 @@ jobs:
   id:
     name: Remote Caller ID ${{ github.event.inputs.caller_id }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - env:
           CALLER_ID: ${{ github.event.inputs.caller_id }}
@@ -66,6 +65,8 @@ jobs:
     name: Build
     needs: id
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: catchpoint/workflow-telemetry-action@v2

.github/workflows/crowdin.yaml

@@ -15,10 +15,6 @@ on:
   # Manually trigger the workflow
   workflow_dispatch:
 
-permissions:
-  contents: write
-  pull-requests: write
-
 jobs:
   # in uses, cannot use environment variable for {owner}/{repo} nor matrix strategy variable for {ref}
   # thus hardcoding them
@@ -27,9 +23,15 @@ jobs:
     uses: nuxeo/nuxeo-web-ui/.github/workflows/crowdin.yaml@lts-2025
     secrets: inherit
     needs: crowdin
+    permissions:
+      contents: write
+      pull-requests: write
 
   crowdin:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - name: Checkout

.github/workflows/ftest.yaml

@@ -21,9 +21,6 @@ on:
       REPOSITORY_MANAGER_PASSWORD:
         required: true
 
-permissions:
-  contents: read
-
 env:
   NPM_REPOSITORY: https://packages.nuxeo.com/repository/npm-public/
   NODE_OPTIONS: "--max-old-space-size=2048"
@@ -33,6 +30,8 @@ jobs:
   ftests:
     runs-on:
       group: medium-4cpu-runners
+    permissions:
+      contents: read
 
     steps:
       - name: Debug

.github/workflows/lint.yaml

@@ -15,15 +15,14 @@ on:
       NPM_PACKAGES_TOKEN:
         required: true
 
-permissions:
-  contents: read
-
 env:
   BRANCH_NAME: ${{ github.head_ref || inputs.branch || 'maintenance-3.1.x' }}
 
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@v6

.github/workflows/main.yaml

@@ -6,17 +6,18 @@ on:
       - maintenance-3.1.x
   workflow_dispatch:
 
-permissions:
-  contents: write
-
 jobs:
   lint:
     uses: ./.github/workflows/lint.yaml
+    permissions:
+      contents: read
     secrets:
       NPM_PACKAGES_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
 
   test:
     uses: ./.github/workflows/test.yaml
+    permissions:
+      contents: read
     secrets:
       NPM_PACKAGES_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
       SAUCE_ACCESS_KEY: ${{ secrets.SAUCE_ACCESS_KEY }}
@@ -25,6 +26,8 @@ jobs:
 
   a11y:
     uses: ./.github/workflows/a11y.yaml
+    permissions:
+      contents: read
     secrets:
       NPM_PACKAGES_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
       REPOSITORY_MANAGER_USERNAME: ${{ secrets.REPOSITORY_MANAGER_USERNAME }}
@@ -34,6 +37,8 @@ jobs:
 
   sonar:
     uses: ./.github/workflows/sonar.yaml
+    permissions:
+      contents: read
     secrets:
       NPM_PACKAGES_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -42,6 +47,8 @@ jobs:
 
   ftest:
     uses: ./.github/workflows/ftest.yaml
+    permissions:
+      contents: read
     secrets:
       NPM_PACKAGES_TOKEN: ${{ secrets.NPM_PACKAGES_TOKEN }}
       REPOSITORY_MANAGER_USERNAME: ${{ secrets.REPOSITORY_MANAGER_USERNAME }}
@@ -53,6 +60,8 @@ jobs:
     needs: [lint, test, a11y, ftest, sonar]
     runs-on:
       group: medium-4cpu-runners
+    permissions:
+      contents: write
 
     steps:
       - uses: catchpoint/workflow-telemetry-action@v2

.github/workflows/preview.yaml

@@ -24,14 +24,12 @@ env:
   GKE_CLUSTER: jx-prod
   GKE_ZONE: us-east1-b
 
-permissions:
-  contents: read
-  pull-requests: write
-
 jobs:
   id:
     name: Remote Caller ID ${{ github.event.inputs.caller_id }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - run: echo run identifier ${{ github.event.inputs.caller_id }}
 
@@ -45,6 +43,9 @@ jobs:
       contains(github.event.pull_request.labels.*.name, 'preview') ||
       github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
 
     steps:
       - uses: actions/setup-node@v6
@@ -190,6 +191,8 @@ jobs:
     name: "Result: ${{ needs.preview.outputs.url }}"
     needs: preview
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     if: github.event_name == 'workflow_dispatch'
     steps:
       - run: echo ${{ needs.preview.outputs.url }}

.github/workflows/promote.yaml

@@ -15,12 +15,11 @@ on:
         type: boolean
         required: false
 
-permissions:
-  contents: write
-
 jobs:
   promote:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/setup-node@v6
         with: