Tighten GHA permissions (#7348)

Author: achamayou

.github/workflows/README.md

@@ -1,6 +1,8 @@
-Documents the various GitHub Actions workflows, the role they fulfil and 3rd party dependencies if any.
+Documents the various GitHub Actions workflows, the role they fulfill and 3rd party (i.e. outside of https://github.com/actions/) dependencies if any.
 
-# Bencher
+# Maintained
+
+## Bencher
 
 Builds and runs CCF performance tests, both end to end and micro-benchmarks. Results are posted to bencher.dev, and [plotted to make regressions obvious](https://bencher.dev/console/projects/ccf/plots).
 Triggered on every commit on `main`, but not on PR builds because the setup required to build from forks is complex and fragile in terms of security, and the increase in pool usage would be substantial.
@@ -12,18 +14,14 @@ File: `bencher.yml`
 
 - `bencherdev/bencher@main`
 
-# Continuous Integration Containers GHCR
+## Bencher A/B
 
-Produces the build images used by CI and release workflows between 5.0.0-rc0 and 6.0.0 (excluded). Complete images are attested and published to GHCR. Triggered on label creation (`build/*`).
+Builds and runs CCF performance tests, and perform a comparison to main. Triggered on PRs that have the label `bench-ab`.
 
-File: `ci-containers-ghcr.yml`
+File: `bencher-ab.yml`
 3rd party dependencies:
 
-- `docker/login-action@v3`
-- `docker/metadata-action@v5`
-- `docker/build-push-action@v6`
-
-Note: This job is being kept until 5.0.x goes out of support.
+- `bencherdev/bencher@main`
 
 # Continuous Integration
 
@@ -76,18 +74,12 @@ Produces CCF reference release artefacts from 5.0.0-rc0 onwards, for all languag
 File: `release.yml`
 3rd party dependencies: None
 
-# Containers GHCR
-
-Produces reference release images for 5.x release versions. Not used from 6.0.0 onwards. Complete images are attested and published to GHCR. Triggered on release publishing.
-
-File: `containers-ghcr.yml`
-3rd party dependencies:
+# Release Attestation
 
-- `docker/login-action@v3`
-- `docker/metadata-action@v5`
-- `docker/build-push-action@v6`
+Generate signed build provenance attestations for release artifacts. Triggered by release creation.
 
-Note: This job is being kept until 5.0.x goes out of support.
+File: `release-attestation.yml`
+3rd party dependencies: None
 
 # NPM
 
@@ -111,3 +103,27 @@ File: `doc.yml`
 3rd party dependencies:
 
 - peaceiris/actions-gh-pages@v3
+
+# Mothballed Actions
+
+## Continuous Integration Containers GHCR
+
+Produces the build images used by CI and release workflows for 5.x releases. Complete images are attested and published to GHCR. Triggered on label creation (`build/*`).
+
+File: `ci-containers-ghcr.yml`
+3rd party dependencies:
+
+- `docker/login-action@v3`
+- `docker/metadata-action@v5`
+- `docker/build-push-action@v6`
+
+## Containers GHCR
+
+Produces reference release images for 5.x release versions. Not used from 6.0.0 onwards. Complete images are attested and published to GHCR. Triggered on release publishing.
+
+File: `containers-ghcr.yml`
+3rd party dependencies:
+
+- `docker/login-action@v3`
+- `docker/metadata-action@v5`
+- `docker/build-push-action@v6`

.github/workflows/bencher-ab.yml

@@ -11,6 +11,8 @@ on:
       - opened
       - reopened
 
+permissions: read-all
+
 jobs:
   benchmark_pr:
     name: Benchmark PR

.github/workflows/bencher.yml

@@ -8,6 +8,8 @@ on:
       - main
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   benchmark_virtual:
     name: Benchmark Virtual

.github/workflows/ci-verification.yml

@@ -14,10 +14,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  actions: read
-  contents: read
-  security-events: write
+permissions: read-all
 
 jobs:
   model-checking-consistency:

.github/workflows/ci.yml

@@ -11,10 +11,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ !contains(github.ref, 'main')}}
 
-permissions:
-  contents: read
-  actions: read
-  checks: write
+permissions: read-all
 
 jobs:
   checks:

.github/workflows/doc.yml

@@ -6,6 +6,8 @@ on:
       - main
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   build:
     name: Build
@@ -56,15 +58,15 @@ jobs:
         with:
           path: build/html
 
-  # This is purposefully separate to keep the scope with
-  # with the permissions to deploy to a minimum.
   deploy:
     name: Deploy
     needs: build
     runs-on: ubuntu-latest
     permissions:
-      contents: read
+      # Needed to authorize deployment to GitHub Pages
       pages: write
+      # Needed to authenticate via OIDC
+      # See https://github.com/actions/deploy-pages?tab=readme-ov-file#usage
       id-token: write
     environment:
       name: github-pages

.github/workflows/long-test.yml

@@ -11,6 +11,8 @@ on:
     - cron: "0 0 * * 1-5"
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   long-asan:
     if: ${{ contains(github.event.pull_request.labels.*.name, 'run-long-test') || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'}}

.github/workflows/long-verification.yml

@@ -11,10 +11,7 @@ on:
     - cron: "0 0 * * 0"
   workflow_dispatch:
 
-permissions:
-  actions: read
-  contents: read
-  security-events: write
+permissions: read-all
 
 jobs:
   model-checking-with-atomic-reconfig-consensus:

.github/workflows/pypi.yml

@@ -32,4 +32,4 @@ jobs:
           python3 -m venv env
           source ./env/bin/activate
           pip install twine
-          twine upload -u __token__ -p ${{ secrets.PYPI_TOKEN }} *.whl
+          twine upload -u __token__ -p ${{ secrets.PYPI_TOKEN }} --skip-existing *.whl

.github/workflows/release-attestation.yml

@@ -10,12 +10,17 @@ on:
         required: true
         type: string
 
+permissions: read-all
+
 jobs:
   attest-release-assets:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      # Necessary to persist attestations
       attestations: write
+      # OIDC authentication is needed to produce the attestation
+      # See https://github.com/actions/attest-build-provenance?tab=readme-ov-file#usage
       id-token: write
     steps:
       - name: Download release assets