Merge branch 'main' into al-pragliola-20250814-sync

Author: Al-Pragliola

.github/workflows/async-upload-test.yml

@@ -16,6 +16,9 @@ on:
       - "jobs/async-upload/**"
       - ".github/workflows/**"
 
+permissions:
+  contents: read
+
 env:
   # Async Job
   JOB_IMG_REGISTRY: quay.io

.github/workflows/build-and-push-csi-image.yml

@@ -23,6 +23,9 @@ env:
 jobs:
   build-csi-image:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       # Assign context variable for various action contexts (tag, main, CI)
       - name: Assigning tag context

.github/workflows/build-and-push-image.yml

@@ -22,6 +22,9 @@ jobs:
   prepare:
     uses: ./.github/workflows/prepare.yml
   build-image:
+    permissions:
+      contents: read
+      packages: write
     runs-on: ubuntu-latest
     needs: prepare
     steps:

.github/workflows/build-image-pr.yml

@@ -11,6 +11,10 @@ on:
       - ".github/dependabot.yml"
       - "docs/**"
       - "clients/python/**"
+
+permissions:
+  contents: read
+
 env:
   IMG_REGISTRY: quay.io
   IMG_ORG: opendatahub

.github/workflows/build-image-ui-pr.yml

@@ -10,6 +10,11 @@ on:
       - "!**.gitignore"
       - "!**.md"
       - "!**.txt"
+
+permissions:
+  contents: read
+  packages: read
+
 env:
   IMG_ORG: kubeflow
   IMG_REPO: model-registry-ui

.github/workflows/build.yml

@@ -13,6 +13,10 @@ on:
       - ".github/ISSUE_TEMPLATE/**"
       - ".github/dependabot.yml"
       - "docs/**"
+
+permissions:
+  contents: read
+
 jobs:
   prepare:
     uses: ./.github/workflows/prepare.yml

.github/workflows/check-db-schema-structs.yaml

@@ -6,6 +6,10 @@ on:
       - 'main'
     tags:
       - 'v*'
+
+permissions:
+  contents: read
+
 jobs:
   check-mysql-schema-structs:
     runs-on: ubuntu-latest

.github/workflows/check-openapi-spec-pr.yaml

@@ -4,6 +4,10 @@ on:
     paths:
       - ".github/workflows/**"
       - "api/openapi/model-registry.yaml"
+
+permissions:
+  contents: read
+
 jobs:
   validate:
     runs-on: ubuntu-latest

.github/workflows/controller-test.yml

@@ -20,6 +20,9 @@ on:
       - "pkg/openapi/**"
       - "go.mod"
 
+permissions:
+  contents: read
+
 env:
   BRANCH: ${{ github.base_ref }}
 jobs:

.github/workflows/csi-test.yml

@@ -21,6 +21,9 @@ on:
       # csi build depends on base go.mod https://github.com/kubeflow/model-registry/issues/311
       - "go.mod"
 
+permissions:
+  contents: read
+
 env:
   IMG_REGISTRY: quay.io
   IMG_ORG: opendatahub