From 143a4d98185b5db90f1090090ba3a90d9e695d18 Mon Sep 17 00:00:00 2001
From: Matthias Bertschy <matthias.bertschy@gmail.com>
Date: Fri, 13 Oct 2023 15:20:52 +0200
Subject: [PATCH] add top level permissions: read-all for openssf

Signed-off-by: Matthias Bertschy <matthias.bertschy@gmail.com>
---
 .github/workflows/00-pr-scanner.yaml                | 5 +++--
 .github/workflows/02-release.yaml                   | 1 +
 .github/workflows/03-post-release.yaml              | 1 +
 .github/workflows/04-publish-krew-plugin.yaml       | 1 +
 .github/workflows/a-pr-scanner.yaml                 | 3 ++-
 .github/workflows/b-binary-build-and-e2e-tests.yaml | 2 +-
 .github/workflows/build-image.yaml                  | 2 +-
 .github/workflows/c-create-release.yaml             | 1 +
 .github/workflows/comments.yaml                     | 4 +---
 .github/workflows/d-publish-image.yaml              | 3 ++-
 .github/workflows/z-close-typos-issues.yaml         | 1 +
 11 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/00-pr-scanner.yaml b/.github/workflows/00-pr-scanner.yaml
index 223e7b78..6d627239 100644
--- a/.github/workflows/00-pr-scanner.yaml
+++ b/.github/workflows/00-pr-scanner.yaml
@@ -1,4 +1,5 @@
 name: 00-pr_scanner
+permissions: read-all
 on:
   pull_request:
     types: [opened, reopened, synchronize, ready_for_review]
@@ -12,7 +13,7 @@ on:
       - 'docs/*'
       - 'build/*'
       - '.github/*'
-      
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -26,7 +27,7 @@ jobs:
       RELEASE: ""
       CLIENT: test
     secrets: inherit
- 
+
   binary-build:
     uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
     with:
diff --git a/.github/workflows/02-release.yaml b/.github/workflows/02-release.yaml
index 7ae65445..d1b72248 100644
--- a/.github/workflows/02-release.yaml
+++ b/.github/workflows/02-release.yaml
@@ -1,4 +1,5 @@
 name: 02-create_release
+permissions: read-all
 on:
   push:
     tags:
diff --git a/.github/workflows/03-post-release.yaml b/.github/workflows/03-post-release.yaml
index 909119d3..d9a3d919 100644
--- a/.github/workflows/03-post-release.yaml
+++ b/.github/workflows/03-post-release.yaml
@@ -1,4 +1,5 @@
 name: 03-post_release
+permissions: read-all
 on:
   release:
     types: [published]
diff --git a/.github/workflows/04-publish-krew-plugin.yaml b/.github/workflows/04-publish-krew-plugin.yaml
index 2b346dce..75fc2170 100644
--- a/.github/workflows/04-publish-krew-plugin.yaml
+++ b/.github/workflows/04-publish-krew-plugin.yaml
@@ -1,4 +1,5 @@
 name: 04-publish_krew_plugin
+permissions: read-all
 on:
   push:
     tags:
diff --git a/.github/workflows/a-pr-scanner.yaml b/.github/workflows/a-pr-scanner.yaml
index b1cd9e3b..b12f494e 100644
--- a/.github/workflows/a-pr-scanner.yaml
+++ b/.github/workflows/a-pr-scanner.yaml
@@ -1,4 +1,5 @@
 name: a-pr-scanner
+permissions: read-all
 on:
   workflow_call:
     inputs:
@@ -68,7 +69,7 @@ jobs:
 
       - name: Convert coverage count to lcov format
         uses: jandelgado/gcov2lcov-action@v1
-        
+
       - name: Submit coverage tests to Coveralls
         continue-on-error: true
         uses: coverallsapp/github-action@v1
diff --git a/.github/workflows/b-binary-build-and-e2e-tests.yaml b/.github/workflows/b-binary-build-and-e2e-tests.yaml
index 7d8626cb..f556e3d8 100644
--- a/.github/workflows/b-binary-build-and-e2e-tests.yaml
+++ b/.github/workflows/b-binary-build-and-e2e-tests.yaml
@@ -1,5 +1,5 @@
 name: b-binary-build-and-e2e-tests
-
+permissions: read-all
 on:
   workflow_dispatch:
     inputs:
diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml
index 68e02154..dc1ab7f5 100644
--- a/.github/workflows/build-image.yaml
+++ b/.github/workflows/build-image.yaml
@@ -1,5 +1,5 @@
 name: build-image
-
+permissions: read-all
 on:
     workflow_dispatch:
       inputs:
diff --git a/.github/workflows/c-create-release.yaml b/.github/workflows/c-create-release.yaml
index eabe3c94..c4832222 100644
--- a/.github/workflows/c-create-release.yaml
+++ b/.github/workflows/c-create-release.yaml
@@ -1,4 +1,5 @@
 name: c-create_release
+permissions: read-all
 on:
   workflow_call:
     inputs:
diff --git a/.github/workflows/comments.yaml b/.github/workflows/comments.yaml
index 20587f1e..134c3060 100644
--- a/.github/workflows/comments.yaml
+++ b/.github/workflows/comments.yaml
@@ -1,5 +1,5 @@
 name: pr-agent
-
+permissions: read-all
 on:
   issue_comment:
 
@@ -19,5 +19,3 @@ jobs:
         env:
           OPENAI_KEY: ${{ secrets.OPENAI_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-   
-
diff --git a/.github/workflows/d-publish-image.yaml b/.github/workflows/d-publish-image.yaml
index 626f3f1f..71422ab0 100644
--- a/.github/workflows/d-publish-image.yaml
+++ b/.github/workflows/d-publish-image.yaml
@@ -1,4 +1,5 @@
 name: d-publish-image
+permissions: read-all
 on:
   workflow_call:
     inputs:
@@ -38,7 +39,7 @@ jobs:
           QUAYIO_REGISTRY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
         run: |
           echo "is-secret-set=${{ env.QUAYIO_REGISTRY_USERNAME != '' && env.QUAYIO_REGISTRY_PASSWORD != '' }}" >> $GITHUB_OUTPUT
-          
+
   build-cli-image:
     needs: [check-secret]
     if: needs.check-secret.outputs.is-secret-set == 'true'
diff --git a/.github/workflows/z-close-typos-issues.yaml b/.github/workflows/z-close-typos-issues.yaml
index 722907da..6e29f564 100644
--- a/.github/workflows/z-close-typos-issues.yaml
+++ b/.github/workflows/z-close-typos-issues.yaml
@@ -1,3 +1,4 @@
+permissions: read-all
 on:
   issues:
     types: [opened, labeled]