chore: restrict GitHub workflow permissions - future-proof

[incertum]

See swiftlang/github-workflows#167 for additional context

This approach aligns with security best practices, as detailed in the following documentation:

• https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
• https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes
• https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/

[ahoppen]

Thanks a lot for the PR, @incertum 🙏🏽 Two quick questions:

• Out of curiosity, do you know what the default permissions are if they are not specified? Does this PR just
• The automerge workflow requires contents: write permission in the create_merge_pr job. Do you know / did you check if it’s possible that a job has more permissions than the surrounding workflow?

[incertum]

Thanks a lot for the PR, @incertum 🙏🏽 Two quick questions:

• Out of curiosity, do you know what the default permissions are if they are not specified?

The default GITHUB_TOKEN permissions are defined at the repository level. This PR modifies the workflow-level overrides to conform to OpenSSF best practices -> defense in depth.

• The automerge workflow requires contents: write permission in the create_merge_pr job. Do you know / did you check if it’s possible that a job has more permissions than the surrounding workflow?

I replied to a similar question here: swiftlang/swift-build#858 (comment) Hope it answers the question?

[ahoppen]

Thanks for the clarification, @incertum 🙏🏽

[ahoppen]

@swift-ci Please test