workflows: Set top-level permissions to empty

The default suggestion for top-level permissions was `contents: read`, but scorecard notes anything other than empty, so try updating it and see if there are any issues. I think it's only needed if we run workflows from other repos. Signed-off-by: stevenhorsman <steven@uk.ibm.com>
2025-08-31 16:36:38 +00:00 · 2025-08-22 14:09:24 +01:00
parent f79e453313
commit b4545da15d
48 changed files with 53 additions and 98 deletions
--- a/.github/workflows/PR-wip-checks.yaml
+++ b/.github/workflows/PR-wip-checks.yaml
@@ -9,8 +9,7 @@ on:
      - labeled
      - unlabeled

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -11,8 +11,8 @@ on:
    paths:
      - '.github/workflows/**'

-permissions:
-  contents: read
+permissions: {}
+

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/basic-ci-amd64.yaml
+++ b/.github/workflows/basic-ci-amd64.yaml
@@ -13,8 +13,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-containerd-sandboxapi:
--- a/.github/workflows/basic-ci-s390x.yaml
+++ b/.github/workflows/basic-ci-s390x.yaml
@@ -13,8 +13,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-containerd-sandboxapi:
--- a/.github/workflows/build-checks-preview-riscv64.yaml
+++ b/.github/workflows/build-checks-preview-riscv64.yaml
@@ -12,8 +12,7 @@ on:
        required: true
        type: string

-permissions:
-  contents: read
+permissions: {}

 name: Build checks preview riscv64
 jobs:
--- a/.github/workflows/build-checks.yaml
+++ b/.github/workflows/build-checks.yaml
@@ -5,8 +5,8 @@ on:
        required: true
        type: string

-permissions:
-  contents: read
+permissions: {}
+

 name: Build checks
 jobs:
--- a/.github/workflows/build-kata-static-tarball-amd64.yaml
+++ b/.github/workflows/build-kata-static-tarball-amd64.yaml
@@ -26,8 +26,7 @@ on:
      KBUILD_SIGN_PIN:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-asset:
--- a/.github/workflows/build-kata-static-tarball-arm64.yaml
+++ b/.github/workflows/build-kata-static-tarball-arm64.yaml
@@ -24,8 +24,7 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: false

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-asset:
--- a/.github/workflows/build-kata-static-tarball-ppc64le.yaml
+++ b/.github/workflows/build-kata-static-tarball-ppc64le.yaml
@@ -24,8 +24,7 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-asset:
--- a/.github/workflows/build-kata-static-tarball-riscv64.yaml
+++ b/.github/workflows/build-kata-static-tarball-riscv64.yaml
@@ -24,8 +24,7 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-asset:
--- a/.github/workflows/build-kata-static-tarball-s390x.yaml
+++ b/.github/workflows/build-kata-static-tarball-s390x.yaml
@@ -27,8 +27,7 @@ on:
        required: true


-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-asset:
--- a/.github/workflows/cargo-deny-runner.yaml
+++ b/.github/workflows/cargo-deny-runner.yaml
@@ -11,8 +11,7 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  cargo-deny-runner:
--- a/.github/workflows/ci-coco-stability.yaml
+++ b/.github/workflows/ci-coco-stability.yaml
@@ -9,8 +9,7 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  kata-containers-ci-on-push:
--- a/.github/workflows/ci-devel.yaml
+++ b/.github/workflows/ci-devel.yaml
@@ -2,8 +2,7 @@ name: Kata Containers CI (manually triggered)
 on:
  workflow_dispatch:

-permissions:
-  contents: read
+permissions: {}

 jobs:
  kata-containers-ci-on-push:
--- a/.github/workflows/ci-nightly-s390x.yaml
+++ b/.github/workflows/ci-nightly-s390x.yaml
@@ -4,8 +4,7 @@ on:

 name: Nightly CI for s390x

-permissions:
-  contents: read
+permissions: {}

 jobs:
  check-internal-test-result:
--- a/.github/workflows/ci-nightly.yaml
+++ b/.github/workflows/ci-nightly.yaml
@@ -7,8 +7,7 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  kata-containers-ci-on-push:
--- a/.github/workflows/ci-on-push.yaml
+++ b/.github/workflows/ci-on-push.yaml
@@ -13,8 +13,7 @@ on:
      - reopened
      - labeled

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/ci-weekly.yaml
+++ b/.github/workflows/ci-weekly.yaml
@@ -30,8 +30,7 @@ on:
      KBUILD_SIGN_PIN:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-kata-static-tarball-amd64:
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -19,8 +19,8 @@ on:
  schedule:
    - cron: '45 0 * * 1'

-permissions:
-  contents: read
+permissions: {}
+

 jobs:
  analyze:
--- a/.github/workflows/commit-message-check.yaml
+++ b/.github/workflows/commit-message-check.yaml
@@ -6,8 +6,7 @@ on:
      - reopened
      - synchronize

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/darwin-tests.yaml
+++ b/.github/workflows/darwin-tests.yaml
@@ -6,8 +6,7 @@ on:
      - reopened
      - synchronize

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/docs-url-alive-check.yaml
+++ b/.github/workflows/docs-url-alive-check.yaml
@@ -2,8 +2,7 @@ on:
  schedule:
    - cron:  '0 23 * * 0'

-permissions:
-  contents: read
+permissions: {}

 name: Docs URL Alive Check
 jobs:
--- a/.github/workflows/gatekeeper-skipper.yaml
+++ b/.github/workflows/gatekeeper-skipper.yaml
@@ -31,8 +31,7 @@ on:
      skip_static:
        value: ${{ jobs.skipper.outputs.skip_static }}

-permissions:
-  contents: read
+permissions: {}

 jobs:
  skipper:
--- a/.github/workflows/gatekeeper.yaml
+++ b/.github/workflows/gatekeeper.yaml
@@ -12,8 +12,7 @@ on:
      - reopened
      - labeled

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/govulncheck.yaml
+++ b/.github/workflows/govulncheck.yaml
@@ -3,8 +3,7 @@ on:

 name: Govulncheck

-permissions:
-  contents: read
+permissions: {}

 jobs:
  govulncheck:
@@ -14,12 +13,12 @@ jobs:
        include:
          - binary: "kata-runtime"
            make_target: "runtime"
-          - binary: "containerd-shim-kata-v2" 
+          - binary: "containerd-shim-kata-v2"
            make_target: "containerd-shim-v2"
          - binary: "kata-monitor"
            make_target: "monitor"
      fail-fast: false
-    
+
    steps:
      - name: Checkout the code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
--- a/.github/workflows/kata-runtime-classes-sync.yaml
+++ b/.github/workflows/kata-runtime-classes-sync.yaml
@@ -6,8 +6,7 @@ on:
      - reopened
      - synchronize

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/payload-after-push.yaml
+++ b/.github/workflows/payload-after-push.yaml
@@ -5,8 +5,7 @@ on:
      - main
  workflow_dispatch:

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/publish-kata-deploy-payload.yaml
+++ b/.github/workflows/publish-kata-deploy-payload.yaml
@@ -34,8 +34,7 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  kata-payload:
--- a/.github/workflows/release-amd64.yaml
+++ b/.github/workflows/release-amd64.yaml
@@ -11,8 +11,7 @@ on:
      KBUILD_SIGN_PIN:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-kata-static-tarball-amd64:
--- a/.github/workflows/release-arm64.yaml
+++ b/.github/workflows/release-arm64.yaml
@@ -9,8 +9,7 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-kata-static-tarball-arm64:
--- a/.github/workflows/release-ppc64le.yaml
+++ b/.github/workflows/release-ppc64le.yaml
@@ -9,8 +9,7 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-kata-static-tarball-ppc64le:
--- a/.github/workflows/release-s390x.yaml
+++ b/.github/workflows/release-s390x.yaml
@@ -11,8 +11,7 @@ on:
      QUAY_DEPLOYER_PASSWORD:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  build-kata-static-tarball-s390x:
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -2,8 +2,7 @@ name: Release Kata Containers
 on:
  workflow_dispatch

-permissions:
-  contents: read
+permissions: {}

 jobs:
  release:
--- a/.github/workflows/run-cri-containerd-tests.yaml
+++ b/.github/workflows/run-cri-containerd-tests.yaml
@@ -1,7 +1,6 @@
 name: CI | Run cri-containerd tests

-permissions:
-  contents: read
+permissions: {}

 on:
  workflow_call:
--- a/.github/workflows/run-k8s-tests-on-amd64.yaml
+++ b/.github/workflows/run-k8s-tests-on-amd64.yaml
@@ -22,8 +22,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-k8s-tests-amd64:
--- a/.github/workflows/run-k8s-tests-on-arm64.yaml
+++ b/.github/workflows/run-k8s-tests-on-arm64.yaml
@@ -22,8 +22,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-k8s-tests-on-arm64:
--- a/.github/workflows/run-k8s-tests-on-ppc64le.yaml
+++ b/.github/workflows/run-k8s-tests-on-ppc64le.yaml
@@ -22,8 +22,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-k8s-tests:
--- a/.github/workflows/run-k8s-tests-on-zvsi.yaml
+++ b/.github/workflows/run-k8s-tests-on-zvsi.yaml
@@ -25,8 +25,7 @@ on:
      AUTHENTICATED_IMAGE_PASSWORD:
        required: true

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-k8s-tests:
--- a/.github/workflows/run-kata-deploy-tests.yaml
+++ b/.github/workflows/run-kata-deploy-tests.yaml
@@ -22,8 +22,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-kata-deploy-tests:
--- a/.github/workflows/run-kata-monitor-tests.yaml
+++ b/.github/workflows/run-kata-monitor-tests.yaml
@@ -13,8 +13,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-monitor:
--- a/.github/workflows/run-metrics.yaml
+++ b/.github/workflows/run-metrics.yaml
@@ -22,8 +22,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-metrics:
--- a/.github/workflows/run-runk-tests.yaml
+++ b/.github/workflows/run-runk-tests.yaml
@@ -13,8 +13,7 @@ on:
        type: string
        default: ""

-permissions:
-  contents: read
+permissions: {}

 jobs:
  run-runk:
--- a/.github/workflows/shellcheck.yaml
+++ b/.github/workflows/shellcheck.yaml
@@ -10,8 +10,7 @@ on:
      - reopened
      - synchronize

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/shellcheck_required.yaml
+++ b/.github/workflows/shellcheck_required.yaml
@@ -11,8 +11,7 @@ on:
      - reopened
      - synchronize

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -4,8 +4,7 @@ on:
    - cron: '0 0 * * *'
  workflow_dispatch:

-permissions:
-  contents: read
+permissions: {}

 jobs:
  stale:
--- a/.github/workflows/static-checks-self-hosted.yaml
+++ b/.github/workflows/static-checks-self-hosted.yaml
@@ -6,8 +6,7 @@ on:
      - reopened
      - labeled # a workflow runs only when the 'ok-to-test' label is added

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/static-checks.yaml
+++ b/.github/workflows/static-checks.yaml
@@ -7,8 +7,7 @@ on:
      - synchronize
  workflow_dispatch:

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -5,8 +5,7 @@ on:
    branches: ["main"]
  pull_request:

-permissions:
-  contents: read
+permissions: {}

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}