Fix: Set minimal permissions to github workflows

[joycebrum]

Description

Closes #4567

Run tests:

• CI (ci.yml): success example
• Config (configure.yml): success example
• Format (format.yml): success example
• Labeler (labeler.yml): success example; PR labeled (I’ve tested without the if clause just to simplify the test case)
• Pip (pip.yml): success example. It skipped the Upload to PyPi step which does not seems to need any more github permission than contents: read
• Upstream (upstream.yml): succes example

Suggested changelog entry:

Set minimal permission to GitHub Workflows

[rwgk]

Everything is working, thanks!

What if someone sends a PR that removes those settings again? Do we have to change some global settings? So that removing the workflow-specific settings means read-only? (Does that question make sense?)

[joycebrum]

What if someone sends a PR that removes those settings again? Do we have to change some global settings? So that removing the workflow-specific settings means read-only? (Does that question make sense?)

Yeah it does! It is possible to change the default permission of the workflows to read only so, even if at some moment this permission got omitted from the file or a new workflow is submitted without the minimal permission needed configured, it will only be granted the configured default permissions.

See Setting the permissions of the GITHUB_TOKEN for your repository to know how to configure it.

[henryiii]

I've changed the setting. Could some of this be simplified now? I'm guessing the read-all could be removed?

[henryiii]

Is this the only line that's needed now that we've changed the default to read only?

[joycebrum]

It is also considered a good practice to keep the minimal permission set on the workflow:

1. It provides transparency in the permissions used since the settings are not public
2. It works as a double prevention by preventing from insider risks (since users with admin access can revert the default permissions)

I personally would recommend to keep the minimal permission set on the workflow files either, but if you rather remove them I'd say that the only ones that should stay would be labeler.yml and ci.yml.

PS: ci.yml does not work only with contents and package read.

[rwgk]

considered a good practice to keep the minimal permission set on the workflow

Sounds good to me, thanks a lot Joyce!

[rwgk]

What if someone sends a PR that removes those settings again? Do we have to change some global settings? So that removing the workflow-specific settings means read-only? (Does that question make sense?)

Yeah it does! It is possible to change the default permission of the workflows to read only so, even if at some moment this permission got omitted from the file or a new workflow is submitted without the minimal permission needed configured, it will only be granted the configured default permissions.

See Setting the permissions of the GITHUB_TOKEN for your repository to know how to configure it.

@joycebrum JIC http://github.com/google/pywrapcc is also on your radar: I just changed the setting there as well and imported this PR (google/pybind11clif#30039).