CI: prevent cache poisoning on pull_request events

[SyedAhad01]

Prevent cache poisoning by skipping the cache save step on pull_request events.
Only push events to main/releasebranch_* are allowed to write to the cache.

Fixes the zizmor security audit finding in ubuntu.yml.

[echoix]

Apart from the changed beginning and end of the file, it seems like a reasonable restriction to only save the cache when it's the main branch.

[echoix]

Please review manually, as a human, the diff of this PR in the GitHub interface, and get back to us when you think it is really ready to review

[SyedAhad01]

Sir, I have reviewed the diff manually. The changes look correct:

1. Removed the top-level permissions block
2. Added permissions block inside the ubuntu job
3. Cache save step is blocked on pull_request events to prevent cache poisoning

[SyedAhad01]

Thank you @rouault for referencing this PR in GDAL!
It's great to see this security fix being adopted
across OSGeo projects.

I will address the requested changes shortly.

[SyedAhad01]

Hi @echoix, all 27 CI checks are now passing.
Could you please re-review when you get a chance?
Thank you

[petrasovaa]

@echoix unless I made a mistake, it looks like this is somehow breaking the documentation, see e.g:
https://grass.osgeo.org/grass-devel/manuals/r.clump.html

I downloaded the documentation builds before and after this PR and this seems to break it.

[echoix]

I'll take a Quick look, but did you download the artifact or from the server? Markus updated the server to Debian 13, that is missing pdal, and he removed it from the configure step. Does r.clump use pdal?

[echoix]

It doesn't make sense how the docs could be affected, its not the same workflow, and it doesn't touch code.

[nilason]

The updated sever perhaps miss markdown code recognition (in doxygen).
Cc @neteler

[neteler]

Any pointer which missing Debian package that could be?

[echoix]

Its not in doxygen, in mkdocs, python.

See https://github.com/OSGeo/grass/actions/runs/23842115846, the commit before, it has the same content as the artifact that is "broken" ad04bd6

It was launched about 20-30 min after the OSGeo/grass-addons@b1fc344 commit

[echoix]

I did not compare the doxygen artifacts yet

[echoix]

Any pointer which missing Debian package that could be?

You could take a look at what is installed in CI to make a full build of doxygen docs, because the artifact is built there

[echoix]

In this artifact, https://github.com/OSGeo/grass/actions/runs/23748765851 from commit 6284bd5 the day before the change, it seems r.clump is wrong too

So, this isn't related to the server change, nor this PR. Its before

[echoix]

The artifacts before that are expired, so if we want to see something, we could rerun an older commit, but it wont reproduce exactly what was there at that time, (it won't be a definitive test)

[echoix]

Maybe commits from last month?:
26457ae
38e1689
211c7b3

[nilason]

Somehow doxygen is the culprit…

No, doxygen is only generating API docs.

[petrasovaa]

Sorry for the noise then...