GitHub Actions workflow updates

[johnbillion]

This updates the GitHub Actions workflow files to:

• Grant minimally-scoped permissions to each job to adhere to the principle of least privilege
• Specify a timeout on each job to prevent runaway processes consuming too many minutes (the default is 360)

Once this PR is merged, the Settings -> Actions -> Workflow permissions setting can be changed by a repo admin to "Read repository contents and packages permissions".

References

• https://docs.github.com/en/actions/reference/security/secure-use
• https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idtimeout-minutes

Use of AI

Claude Code was used to create the initial changes. All permissions and timeouts changes were reviewed and adjusted by me where necessary.

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions workflows by applying the principle of least privilege (defaulting permissions to none and granting only what each job needs) and by adding explicit timeout-minutes values to prevent runaway jobs.

Changes:

• Set workflow-level permissions: {} across workflows and add job-level permissions (primarily contents: read, with contents: write where publishing is needed).
• Add/standardize timeout-minutes across jobs (including release workflows).
• Update/clarify inline permission rationale comments (e.g., why contents: read/write is required).

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/wp-tests-phpunit.yml	Disables default token permissions and grants contents: read per job; keeps job timeouts.
.github/workflows/wp-tests-end-to-end.yml	Disables default token permissions and grants contents: read for checkout; keeps job timeout.
.github/workflows/wasm-spike.yml	Disables default token permissions and grants contents: read per job; keeps job timeouts.
.github/workflows/verify-version.yml	Disables default token permissions, adds contents: read, and adds a job timeout.
.github/workflows/release-wporg.yml	Disables default token permissions; adds job timeout and keeps contents: read for checkout/release download.
.github/workflows/release-publish.yml	Disables default token permissions; adds job timeout; scopes contents: write for release creation and contents: read for called deploy workflow.
.github/workflows/publish-wasm-extension-artifact.yml	Disables default token permissions; adds job-level permissions (contents: read / contents: write) aligned to build vs publish steps.
.github/workflows/phpunit-tests.yml	Disables default token permissions and adds inline rationale for contents: read on the reusable-workflow job.
.github/workflows/phpunit-tests-run.yml	Disables default token permissions and grants contents: read for checkout within the called workflow job.
.github/workflows/mysql-proxy-tests.yml	Disables default token permissions and grants contents: read for checkout; keeps job timeout.
.github/workflows/mysql-parser-extension-tests.yml	Disables default token permissions and grants contents: read for checkout; keeps job timeout.
.github/workflows/end-to-end-tests.yml	Disables default token permissions and grants contents: read for checkout; keeps job timeout.
.github/workflows/cs.yml	Disables default token permissions; adds job timeout and contents: read for checkout.

Comments suppressed due to low confidence (1)

.github/workflows/cs.yml:44

• actions/checkout@main is a mutable reference and weakens the security posture (supply-chain risk), especially now that workflows are being tightened for least privilege. Pin actions/checkout to a stable tag (e.g., @v4) or a full commit SHA.

      contents: read # Required to clone the repo.

    steps:
      - name: Checkout code
        uses: actions/checkout@main

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[desrosj]

I merged one suggestion from Copilot on this one. Looked valid and reasonable to me. @johnbillion would appreciate a double check when you can.

[johnbillion]

I'm honestly not sure on that one, the workflow has been running without it. But it's safe to add so yes let's keep it.

[desrosj]

Once this PR is merged, the Settings -> Actions -> Workflow permissions setting can be changed by a repo admin to "Read repository contents and packages permissions".

This setting has been changed.