[chore] Minimize github default token permissions (#1003)

trask · opentelemetrybot · otelbot[bot] · web-flow · commit 9124326ec56d · 2025-07-25T18:26:06.000Z
* Add minimum token permissions for all github workflow files (#990) Co-authored-by: otelbot <197425009+otelbot@users.noreply.github.com> * Remove the bad ones * add token permissions to regression test pipeline * remove whitespace * remove whitespace * remove whitespace * remove whitespace * remove whitespace * fix double permission yaml fields --------- Co-authored-by: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com> Co-authored-by: otelbot <197425009+otelbot@users.noreply.github.com> Co-authored-by: Moritz Wiesinger <moritz.wiesinger@dynatrace.com> Co-authored-by: Antoine Toulme <antoine@lunar-ocean.com>
diff --git a/.github/workflows/base-ci-goreleaser.yaml b/.github/workflows/base-ci-goreleaser.yaml
@@ -28,6 +28,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.0
diff --git a/.github/workflows/base-package-tests.yaml b/.github/workflows/base-package-tests.yaml
@@ -15,6 +15,9 @@ on:
         default: false
         description: "Set to true if a GH issue should be generated upon failure"
 
+permissions:
+  contents: read
+
 jobs:
   package-tests:
     name: Package Tests
diff --git a/.github/workflows/base-release.yaml b/.github/workflows/base-release.yaml
@@ -17,6 +17,9 @@ on:
         type: string
         default: ubuntu-24.04
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.0
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
@@ -11,6 +11,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 env:
   # Make sure to exit early if cache segment download times out after 2 minutes.
   # We limit cache download as a whole to 5 minutes.
diff --git a/.github/workflows/ci-builder.yaml b/.github/workflows/ci-builder.yaml
@@ -23,6 +23,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.0
diff --git a/.github/workflows/ci-goreleaser-contrib.yaml b/.github/workflows/ci-goreleaser-contrib.yaml
@@ -23,6 +23,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - Contrib - GoReleaser
diff --git a/.github/workflows/ci-goreleaser-core.yaml b/.github/workflows/ci-goreleaser-core.yaml
@@ -23,6 +23,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - Core - GoReleaser
diff --git a/.github/workflows/ci-goreleaser-ebpf-profiler.yaml b/.github/workflows/ci-goreleaser-ebpf-profiler.yaml
@@ -23,6 +23,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - eBPF Profiler - GoReleaser
diff --git a/.github/workflows/ci-goreleaser-k8s.yaml b/.github/workflows/ci-goreleaser-k8s.yaml
@@ -23,6 +23,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - k8s - GoReleaser
diff --git a/.github/workflows/ci-goreleaser-otlp.yaml b/.github/workflows/ci-goreleaser-otlp.yaml
@@ -23,6 +23,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: CI - OTLP - GoReleaser
diff --git a/.github/workflows/ci-opampsupervisor.yaml b/.github/workflows/ci-opampsupervisor.yaml
@@ -21,6 +21,9 @@ on:
       - "go.mod"
       - "go.sum"
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.0
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -7,6 +7,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/msi-tests.yaml b/.github/workflows/msi-tests.yaml
@@ -10,6 +10,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   msi-tests:
     name: MSI Tests
diff --git a/.github/workflows/package-test.yaml b/.github/workflows/package-test.yaml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: "0 2 * * *" # every day at 2am UTC
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: Build - Contrib - GoReleaser
diff --git a/.github/workflows/regression-tests.yaml b/.github/workflows/regression-tests.yaml
@@ -5,6 +5,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   check-goreleaser:
     name: Check docker token
diff --git a/.github/workflows/release-builder.yaml b/.github/workflows/release-builder.yaml
@@ -4,6 +4,9 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.0
diff --git a/.github/workflows/release-contrib.yaml b/.github/workflows/release-contrib.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release Contrib
diff --git a/.github/workflows/release-core.yaml b/.github/workflows/release-core.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release Core
diff --git a/.github/workflows/release-k8s.yaml b/.github/workflows/release-k8s.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release k8s
diff --git a/.github/workflows/release-opampsupervisor.yaml b/.github/workflows/release-opampsupervisor.yaml
@@ -4,6 +4,9 @@ on:
     tags:
       - "v*"
 
+permissions:
+  contents: read
+
 env:
   # renovate: datasource=github-releases depName=goreleaser/goreleaser-pro
   GORELEASER_PRO_VERSION: v2.11.0
diff --git a/.github/workflows/release-otlp.yaml b/.github/workflows/release-otlp.yaml
@@ -4,6 +4,9 @@ on:
   push:
     tags: ["v*"]
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Release OTLP
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   shellcheck:
     name: Shellcheck
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
@@ -4,8 +4,14 @@ on:
   schedule:
     - cron: "12 5 * * *" # arbitrary time not to DDOS GitHub
 
+permissions:
+  contents: read
+
 jobs:
   stale:
+    permissions:
+      issues: write # required for managing stale issues
+      pull-requests: write # required for managing stale PRs
     runs-on: ubuntu-24.04
     env:
       GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/update-version.yaml b/.github/workflows/update-version.yaml
@@ -15,14 +15,15 @@ on:
         required: false
         default: ''
 
+permissions:
+  contents: read
+
 jobs:
   update-version:
-    runs-on: ubuntu-24.04
-    
     permissions:
       contents: write # required for pushing changes
-      pull-requests: write # required for creating PR
-    
+      pull-requests: write # required for creating PRs
+    runs-on: ubuntu-24.04
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
