Backport workflow-hardening fix (excessive-permissions) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/build-ruby.yml, .github/workflows/cache-cleanup.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 95f139c
• a7bde0c

Affected release branches (5)

• 2.10-stable (still present as of HEAD a70cf66f)
• 2.4-stable (still present as of HEAD 14cdd6fb)
• 1.x-stable (still present as of HEAD 19b2d385)
• 2.2-stable (still present as of HEAD a5820c57)
• 2.0-stable (still present as of HEAD ae634828)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

2.10-stable — excessive-permissions

File .github/workflows/cache-cleanup.yml; suggested edits:

• • jobs.$J.permissions.contents = 'write'

--- a/.github/workflows/cache-cleanup.yml
+++ b/.github/workflows/cache-cleanup.yml
@@ -28,3 +28,5 @@
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GH_REPO: ${{ github.repository }}
           BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge
+    permissions:
+      contents: write

2.4-stable — excessive-permissions

File .github/workflows/build-ruby.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'
• • jobs.$J.permissions.packages = 'write'

--- a/.github/workflows/build-ruby.yml
+++ b/.github/workflows/build-ruby.yml
@@ -118,3 +118,6 @@
         run: |
           docker buildx build . --builder=container --cache-from=type=registry,ref=${{ env.REGISTRY }}/datadog/dd-trace-rb/${{ matrix.engine }}:${{ matrix.version }}-dd --output=type=image,push=true --build-arg BUILDKIT_INLINE_CACHE=1 --platform linux/x86_64,linux/aarch64 -f ${{ matrix.dockerfile }} --tag ${{ env.REGISTRY }}/datadog/dd-trace-rb/${{ matrix.engine }}:${{ matrix.version }}-dd
         working-directory: .circleci/images/primary
+    permissions:
+      contents: read
+      packages: write

1.x-stable — excessive-permissions

File .github/workflows/build-ruby.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'
• • jobs.$J.permissions.packages = 'write'

--- a/.github/workflows/build-ruby.yml
+++ b/.github/workflows/build-ruby.yml
@@ -127,3 +127,6 @@
         run: |
           docker buildx build . --builder=container --cache-from=type=registry,ref=${{ env.REGISTRY }}/datadog/dd-trace-rb/${{ matrix.engine }}:${{ matrix.version }}-dd --output=type=image,push=true --build-arg BUILDKIT_INLINE_CACHE=1 --platform linux/x86_64,linux/aarch64 -f ${{ matrix.dockerfile }} --tag ${{ env.REGISTRY }}/datadog/dd-trace-rb/${{ matrix.engine }}:${{ matrix.version }}-dd
         working-directory: .circleci/images/primary
+    permissions:
+      contents: read
+      packages: write

2.2-stable — excessive-permissions

File .github/workflows/build-ruby.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'
• • jobs.$J.permissions.packages = 'write'

--- a/.github/workflows/build-ruby.yml
+++ b/.github/workflows/build-ruby.yml
@@ -118,3 +118,6 @@
         run: |
           docker buildx build . --builder=container --cache-from=type=registry,ref=${{ env.REGISTRY }}/datadog/dd-trace-rb/${{ matrix.engine }}:${{ matrix.version }}-dd --output=type=image,push=true --build-arg BUILDKIT_INLINE_CACHE=1 --platform linux/x86_64,linux/aarch64 -f ${{ matrix.dockerfile }} --tag ${{ env.REGISTRY }}/datadog/dd-trace-rb/${{ matrix.engine }}:${{ matrix.version }}-dd
         working-directory: .circleci/images/primary
+    permissions:
+      contents: read
+      packages: write

2.0-stable — excessive-permissions

File .github/workflows/build-ruby.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'
• • jobs.$J.permissions.packages = 'write'

--- a/.github/workflows/build-ruby.yml
+++ b/.github/workflows/build-ruby.yml
@@ -115,3 +115,6 @@
         run: |
           docker buildx build . --builder=container --cache-from=type=registry,ref=${{ env.REGISTRY }}/datadog/dd-trace-rb/${{ matrix.engine }}:${{ matrix.version }}-dd --output=type=image,push=true --build-arg BUILDKIT_INLINE_CACHE=1 --platform linux/x86_64,linux/aarch64 -f ${{ matrix.dockerfile }} --tag ${{ env.REGISTRY }}/datadog/dd-trace-rb/${{ matrix.engine }}:${{ matrix.version }}-dd
         working-directory: .circleci/images/primary
+    permissions:
+      contents: read
+      packages: write

---

Happy to open pull requests instead if that's preferred.

[ivoanjo]

Thanks for the heads-up! Actually none of those branches are active for releases, they're only for historical record.