Backport workflow-hardening fix (excessive-permissions) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/protobuf.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 2d4bc0b

Affected release branches (5)

• v0.48 (still present as of HEAD 922598a1)
• v0.45 (still present as of HEAD 0d99581f)
• v0.47 (still present as of HEAD 48a86fd7)
• v0.44 (still present as of HEAD 3cdc7c3d)
• v0.46 (still present as of HEAD 9a19e8a7)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

v0.48 — excessive-permissions

File .github/workflows/protobuf.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/protobuf.yml
+++ b/.github/workflows/protobuf.yml
@@ -26,3 +26,5 @@
       - uses: bufbuild/buf-breaking-action@v1.1.4
         with:
           against: "https://github.com/vectordotdev/vector.git#branch=master"
+permissions:
+  contents: read

v0.45 — excessive-permissions

File .github/workflows/protobuf.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/protobuf.yml
+++ b/.github/workflows/protobuf.yml
@@ -26,3 +26,5 @@
       - uses: bufbuild/buf-breaking-action@v1.1.4
         with:
           against: "https://github.com/vectordotdev/vector.git#branch=master"
+permissions:
+  contents: read

v0.47 — excessive-permissions

File .github/workflows/protobuf.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/protobuf.yml
+++ b/.github/workflows/protobuf.yml
@@ -26,3 +26,5 @@
       - uses: bufbuild/buf-breaking-action@v1.1.4
         with:
           against: "https://github.com/vectordotdev/vector.git#branch=master"
+permissions:
+  contents: read

v0.44 — excessive-permissions

File .github/workflows/protobuf.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/protobuf.yml
+++ b/.github/workflows/protobuf.yml
@@ -26,3 +26,5 @@
       - uses: bufbuild/buf-breaking-action@v1.1.4
         with:
           against: "https://github.com/vectordotdev/vector.git#branch=master"
+permissions:
+  contents: read

v0.46 — excessive-permissions

File .github/workflows/protobuf.yml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/protobuf.yml
+++ b/.github/workflows/protobuf.yml
@@ -26,3 +26,5 @@
       - uses: bufbuild/buf-breaking-action@v1.1.4
         with:
           against: "https://github.com/vectordotdev/vector.git#branch=master"
+permissions:
+  contents: read

---

Happy to open pull requests instead if that's preferred.