github/workflows: set read-only default permissions to approve workflow

[ivanvc]

As discovered by the OpenSSF Scorecard, the gh-workflow-approve.yaml action didn't specify default permissions. This pull request fixes that issue.

Part of #18362.

Please read https://github.com/etcd-io/etcd/blob/main/CONTRIBUTING.md#contribution-flow.

[fuweid]

LGTM

[serathius]

This is intentional. We cannot change status of CI without having write permissions.

Context: #15659

The problem: https://github.com/orgs/community/discussions/49688

[ahrtr]

Probably something like below?

permissions:
  actions:write

[serathius]

That should work! Thanks, I forgot that the issue is about the default permission.

[ivanvc]

I was initially going to set it with explicit permission at the top of the file. However, I based this implementation on other workflows. For example, the scorecard workflow declares the read-all permission at the top of the file:

etcd/.github/workflows/scorecards.yml

Lines 11 to 12 in f00ceb6

	# Declare default permissions as read only.
	permissions: read-all

Then, in the job, sets the write permissions:

etcd/.github/workflows/scorecards.yml

Lines 18 to 22 in f00ceb6

	permissions:
	# Needed to upload the results to code-scanning dashboard.
	security-events: write
	# Used to receive a badge.
	id-token: write

I tested it on my fork, and seems to work fine: https://github.com/ivanvc/etcd/actions/runs/10115486985/job/27976358983?pr=210

Let me know if you still want me to change this.

[ahrtr]

Oh, I just realised that you already added at the job level,

permissions:
  actions:write

https://github.com/ivanvc/etcd/blob/5a02298ad5a947214ba02655b0a93ac01d4c178a/.github/workflows/gh-workflow-approve.yaml#L20-L21

Looks good to me.

[ahrtr]

This PR should be good to merge.

[jmhbnz]

LGTM - Thanks @ivanvc

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ahrtr, fuweid, ivanvc, jmhbnz, serathius

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [ahrtr,jmhbnz,serathius]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment