common: harden GitHub Actions

[osalyk]

This change is 

[grom72]

Reviewed 17 of 17 files at r1, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @osalyk)

a discussion (no related file):
DAOS uses an empty permissions: {} by default. Can we try if it also works for us, instead of contents: read?

---

[osalyk]

Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @grom72)

a discussion (no related file):

Previously, grom72 (Tomasz Gromadzki) wrote…

DAOS uses an empty permissions: {} by default. Can we try if it also works for us, instead of contents: read?

Such a submission disables all access, I'm not sure we can do that.

---

[janekmi]

Reviewed 17 of 17 files at r1, all commit messages.
Reviewable status: all files reviewed, 2 unresolved discussions (waiting on @grom72 and @osalyk)

a discussion (no related file):

Previously, osalyk (Oksana Sałyk) wrote…

Such a submission disables all access, I'm not sure we can do that.

If you do this you will have to add jobs.<job_id>.permissions basically for all our jobs. The default permissions should be set according to what default makes sense in the project.

---

---

.github/workflows/main.yml line 15 at r1 (raw file):

  src_checkers:
    name: Source checkers
    runs-on: ubuntu-latest

contents: read is required by all of the jobs in this file. Whereas issues: read is required only by src_checkers. Luckily we can make use of the semantics of this file and specify permissions on both levels. Where the jobs.<job_id>.permissions adds or removes access as necessary only for the given job.

Ref:

• https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions
• https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#jobsjob_idpermissions

Suggestion:

permissions:
  contents: read

jobs:
  src_checkers:
    name: Source checkers
    runs-on: ubuntu-latest
    permissions:
      issues: read

[janekmi]

Reviewed 1 of 1 files at r2, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @grom72)