ci: add GitHub token permissions for workflows

[varunsh-coder]

Feature or Bugfix

• Security best practice

Detail

This PR adds minimum token permissions for the GITHUB_TOKEN using https://github.com/step-security/secure-workflows.

GitHub recommends defining minimum GITHUB_TOKEN permissions for securing GitHub Actions workflows

• https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
• https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
• The Open Source Security Foundation (OpenSSF) Scorecards treats not setting token permissions as a high-risk issue. Merging this PR will also help improve the Scorecard score for this project.

Signed-off-by: Varun Sharma varunsh@stepsecurity.io

Before this change

GITHUB_TOKEN has write permissions for multiple scopes which are not needed.
e.g. https://github.com/awslabs/aws-data-wrangler/runs/7628091514?check_suite_focus=true#step:1:19

After this change

GITHUB_TOKEN will have minimum permissions needed.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[malachi-constant]

AWS CodeBuild CI Report

• CodeBuild project: GitHubCodeBuild8756EF16-4rfo0GHQ0u9a
• Commit ID: 9470bef
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[malachi-constant]

@varunsh-coder Thanks for the contribution, agreed this is a wise addition