Least privilege permissions (#26700)

This commit updates all the repository workflows to drop all privileges
(or to a bare minimum) and only enables additional capabilities for the
token when required, following the least privilege principle.

Fixes #26686

No

- [x] Covered by existing tests (this is a refactoring)

I've run a test release run (the testable parts at least) here,
https://github.com/puerco/scala3/actions/runs/30780742171

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>

Author: puerco

.github/workflows/build-chocolatey.yml

@@ -23,6 +23,9 @@ on:
         required: true
         type    : string
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest

.github/workflows/build-msi.yml

@@ -17,6 +17,9 @@ on:
         description: 'The developed Scala version (major.minor.patch) extracted from project/Build.scala'
         value: ${{ jobs.build.outputs.version }}
 
+permissions:
+  contents: read
+
 env:
   # Release only happends when triggering CI by pushing tag
   RELEASEBUILD: ${{ startsWith(github.event.ref, 'refs/tags/') && 'yes' || 'no' }}

.github/workflows/build-sdk.yml

@@ -40,6 +40,9 @@ on:
         description: The SHA256 of the uploaded artifact (`win x86-64`)
         value      : ${{ jobs.build.outputs.win-x86_64-digest }}
 
+permissions:
+  contents: read
+  actions: read  # To read back the win-x86_64 artifact through the Actions API
 
 jobs:
   build:

.github/workflows/ci.yaml

@@ -24,6 +24,11 @@ on:
   merge_group:
   workflow_dispatch:
 
+# Default token permissions for all jobs: read-only. Jobs that need more must
+# declare their own permissions block.
+permissions:
+  contents: read
+
 # Cancels any in-progress runs within the same group identified by workflow name and GH reference (branch or tag)
 # For example it would:
 # - terminate previous PR CI execution after pushing more changes to the same PR branch
@@ -245,6 +250,9 @@ jobs:
 
   build-sdk-package:
    uses: ./.github/workflows/build-sdk.yml
+   permissions:
+     contents: read
+     actions: read  # to read back the win-x86_64 artifact through the Actions API
    if:
      (github.event_name == 'pull_request' && !contains(github.event.pull_request.body, '[skip ci]')) ||
      (github.event_name == 'workflow_dispatch' && github.repository == 'scala/scala3') ||
@@ -264,6 +272,8 @@ jobs:
 
   test-chocolatey-package:
    uses: ./.github/workflows/test-chocolatey.yml
+   permissions:
+     actions: read  # downloads the launcher artifact through the Actions API
    with:
      version     : 3.6.0-SNAPSHOT # Fake version, used only for choco tests
      java-version: 17

.github/workflows/dependency-graph.yml

@@ -3,6 +3,10 @@ on:
   push:
     branches:
       - main # default branch of the project
+
+permissions:
+  contents: write  # To submit the dependency graph (in sbt-dependency-submission)
+
 jobs:
   dependency-graph:
     name: Update Dependency Graph

.github/workflows/language-reference.yaml

@@ -15,8 +15,6 @@ permissions:
 jobs:
   build-and-push:
     name: Build reference documentation and push it
-    permissions:
-      contents: write  # for Git to git push
     runs-on: ubuntu-latest
     steps:
       - name: Get current date

.github/workflows/lts-backport.yaml

@@ -5,6 +5,11 @@ on:
     branches:
       - main
 
+# The backporting project is updated via the API with a GitHub App token, the
+# workflow GITHUB_TOKEN is only used to check out the repository.
+permissions:
+  contents: read
+
 jobs:
   add-to-backporting-project:
     if: "!contains(github.event.push.head_commit.message, '[Next only]') &&

.github/workflows/publish-chocolatey.yml

@@ -26,6 +26,9 @@ on:
       API-KEY:
         required: true
 
+# Pushes to Chocolatey with an API key, no GITHUB_TOKEN use
+permissions: {}
+
 jobs:
   publish:
     runs-on: windows-latest

.github/workflows/publish-sdkman.yml

@@ -26,6 +26,9 @@ on:
       CONSUMER-TOKEN:
         required: true
 
+# Publishes to SDKMAN! with vendor credentials no GITHUB_TOKEN use
+permissions: {}
+
 env:
   RELEASE-URL: 'https://github.com/scala/scala3/releases/download/${{ inputs.version }}'
 

.github/workflows/release-maven-artifacts.yml

@@ -7,6 +7,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   release-maven-artifacts:
     runs-on: ubuntu-latest