build: harden worfklows permissions (#4587)

Signed-off-by: sashashura <aleksandrosansan@gmail.com>

Signed-off-by: sashashura <aleksandrosansan@gmail.com>

.github/workflows/gradle-check.yml

@@ -8,8 +8,15 @@ on:
  pull_request_target:
  types: [opened, synchronize, reopened]
 
+permissions:
+ contents: read # to fetch code (actions/checkout)
+
 jobs:
  gradle-check:
+ permissions:
+ contents: read # to fetch code (actions/checkout)
+ pull-requests: write # to create or update comment (peter-evans/create-or-update-comment)
+
  runs-on: ubuntu-latest
  timeout-minutes: 130
  steps:

.github/workflows/links.yml

@@ -2,6 +2,8 @@ name: Link Checker
 on:
  schedule:
  - cron: '0 0 * * *'
+permissions:
+ contents: read # to fetch code (actions/checkout)
 jobs:
  linkchecker:
  if: github.repository == 'opensearch-project/OpenSearch'

.github/workflows/version.yml

@@ -5,6 +5,7 @@ on:
  tags:
  - '*.*.*'
 
+permissions: {}
 jobs:
  build:
  runs-on: ubuntu-latest

CHANGELOG.md

@@ -6,6 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased 3.0]
 ### Added
+- Hardened token permissions in GitHub workflows ([#4587](https://github.com/opensearch-project/OpenSearch/pull/4587))
 - Support for HTTP/2 (server-side) ([#3847](https://github.com/opensearch-project/OpenSearch/pull/3847))
 - Add getter for path field in NestedQueryBuilder ([#4636](https://github.com/opensearch-project/OpenSearch/pull/4636))
 - Apply reproducible builds configuration for OpenSearch plugins through gradle plugin ([#4746](https://github.com/opensearch-project/OpenSearch/pull/4746))