Add explicit least-privilege permissions to GitHub workflows

.github/workflows/ci-complete.yml

@@ -21,6 +21,11 @@ on:
     types:
       - completed
 
+permissions:
+  actions: read
+  contents: read
+  statuses: write
+
 run-name: Build Scans for ${{ github.event.workflow_run.display_title}}
 
 # This workflow runs after the completion of the CI workflow triggered on a "pull_request" event.

.github/workflows/deflake.yml

@@ -36,6 +36,9 @@ on:
         type: string
         default: '17'
 
+permissions:
+  contents: read
+
 jobs:
   deflake:
     runs-on: ubuntu-latest

.github/workflows/docker_build_and_test.yml

@@ -28,6 +28,9 @@ on:
         description: Kafka url to be used to build the docker image
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/docker_official_image_build_and_test.yml

@@ -27,6 +27,9 @@ on:
         description: Kafka version for the docker official image. This should be >=3.7.0
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/docker_promote.yml

@@ -25,6 +25,9 @@ on:
         description: Docker image name of the promoted image (Example:- apache/kafka:3.8.0 (OR) apache/kafka-native:3.8.0)
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   promote:
     if: github.repository == 'apache/kafka'

.github/workflows/docker_rc_release.yml

@@ -31,6 +31,9 @@ on:
         description: Kafka url to be used to build the docker image
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   release:
     if: github.repository == 'apache/kafka'

.github/workflows/docker_scan.yml

@@ -19,6 +19,10 @@ on:
     # This job will run at 3:30 UTC daily
     - cron: '30 3 * * *'
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
   scan_jvm:
     if: github.repository == 'apache/kafka'

.github/workflows/pr-labeled.yml

@@ -20,6 +20,11 @@ on:
     types:
       - labeled
 
+permissions:
+  actions: write
+  contents: read
+  pull-requests: read
+
 jobs:
   approve-workflow-run:
     name: Approve CI

.github/workflows/pr-linter.yml

@@ -21,6 +21,11 @@ on:
     types:
       - completed
 
+permissions:
+  actions: read
+  contents: read
+  statuses: write
+
 jobs:
   lint-pr:
     if: github.event.workflow_run.conclusion == 'success'

.github/workflows/pr-reviewed.yml

@@ -25,6 +25,9 @@ on:
     branches:
       - trunk
 
+permissions:
+  contents: read
+
 jobs:
   save-pr-number:
     name: Save PR Number

.github/workflows/prepare_docker_official_image_source.yml

@@ -26,6 +26,9 @@ on:
       kafka_version:
         description: Kafka version for the docker official image. This should be >=3.7.0
         required: true
+
+permissions:
+  contents: read
 
 jobs:
   build:

.github/workflows/workflow-requested.yml

@@ -21,6 +21,11 @@ on:
     types:
       - requested
 
+permissions:
+  actions: write
+  contents: read
+  pull-requests: read
+
 run-name: Workflow Requested for ${{ github.event.workflow_run.display_title}}
 
 jobs: