ci: standardize and tighten permissions across reusable workflows

.github/workflows/build-publish-container-goreleaser.yml

@@ -41,6 +41,13 @@ on:
       registry_subject_name:
         type: string
         required: true
+
+permissions:
+  contents: write      # release creation, uploading assets
+  packages: write      # docker login, image push, upload container provenance
+  id-token: write      # Sigstore signing (attest-build-provenance)
+  attestations: write  # write build provenance attestations
+
 jobs:
   container_build_publish:
     runs-on: ubuntu-latest

.github/workflows/build-rpm-quadlet.yml

@@ -13,6 +13,10 @@ on:
         description: 'Artifact-name for unsigned RPM artifacts'
         default: 'rpms-unsigned'
         type: string
+
+permissions:
+  contents: read   # baseline for checkout
+
 jobs:
   rpmbuild:
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -8,6 +8,9 @@ on:
   push:
     branches: [ main ]
 
+permissions:
+  contents: read   # baseline for checkout
+
 jobs:
   lint:
     runs-on: ubuntu-latest

.github/workflows/dependency-review.yml

@@ -36,7 +36,7 @@ on:
         default: 'on-failure'
 
 permissions:
-  contents: read
+  contents: read         # baseline for checkout
   pull-requests: write   # for comment-summary-in-pr
 
 jobs:

.github/workflows/docker-build-release.yml

@@ -51,12 +51,18 @@ on:
         type: string
         default: ''
 
-permissions: write-all # Necessary for provenance and SBOM attestations
+permissions:
+  contents: read   # baseline for all jobs
 
 jobs:
   build-push-images:
     environment: 'Docker Push'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read       # checkout repository
+      packages: write      # docker login, image push, upload container provenance
+      id-token: write      # Sigstore signing (built-in provenance)
+      attestations: write  # built-in provenance & SBOM
     steps:
       - name: checkout repository
         uses: actions/checkout@v6.0.3
@@ -151,18 +157,18 @@ jobs:
     needs: build-push-images
     if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
     permissions:
-      contents: write
+      contents: write  # create GitHub release
     steps:
-    - name: Parse semver string
-      id: semver_parser
-      uses: booxmedialtd/ws-action-parse-semver@v1.4.7
-      with:
-        input_string: ${{ github.event.ref }}
-        version_extractor_regex: 'refs/tags/v(.*)$'
-    - uses: ncipollo/release-action@v1.21.0
-      with:
-        # by default this will use the tag push tag as the tag and name
-        # if we want to trigger tagging from the workflow, "tag" and "commit"
-        # need to be set to create a new one
-        prerelease: ${{ steps.semver_parser.outputs.prerelease != '' }}
-        skipIfReleaseExists: true
+      - name: Parse semver string
+        id: semver_parser
+        uses: booxmedialtd/ws-action-parse-semver@v1.4.7
+        with:
+          input_string: ${{ github.event.ref }}
+          version_extractor_regex: 'refs/tags/v(.*)$'
+      - uses: ncipollo/release-action@v1.21.0
+        with:
+          # by default this will use the tag push tag as the tag and name
+          # if we want to trigger tagging from the workflow, "tag" and "commit"
+          # need to be set to create a new one
+          prerelease: ${{ steps.semver_parser.outputs.prerelease != '' }}
+          skipIfReleaseExists: true

.github/workflows/go-build-release.yml

@@ -71,7 +71,11 @@ on:
         type: string
         default: ''
 
-permissions: write-all # Necessary for the generate-build-provenance action with containers
+permissions:
+  contents: write      # release creation, uploading assets
+  packages: write      # docker login, image push, upload container provenance
+  id-token: write      # Sigstore signing (attest-build-provenance)
+  attestations: write  # write build provenance attestations
 
 jobs:
   goreleaser:

.github/workflows/govulncheck.yml

@@ -25,7 +25,7 @@ on:
         default: './...'
 
 permissions:
-  contents: read
+  contents: read   # baseline for checkout
 
 jobs:
   govulncheck:

.github/workflows/gpg-sign-artifacts.yml

@@ -25,6 +25,10 @@ on:
         description: 'Name for the public key composite artifact'
         type: string
         default: 'public-keys'
+
+permissions:
+  contents: read   # baseline for checkout
+
 jobs:
   artifacts-sign:
     runs-on: ubuntu-latest

.github/workflows/lint-workflows.yml

@@ -11,7 +11,7 @@ on:
   workflow_call:
 
 permissions:
-  contents: read
+  contents: read   # baseline for checkout
 
 jobs:
   actionlint:
@@ -29,8 +29,8 @@ jobs:
     name: zizmor
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      security-events: write   # for SARIF upload to GHAS
+      contents: read          # baseline for checkout
+      security-events: write  # for SARIF upload to GHAS
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

.github/workflows/pr-registry-cleanup.yml

@@ -19,7 +19,7 @@ on:
         type: string
 
 permissions:
-  packages: write
+  packages: write   # delete container image versions from GHCR
 
 jobs:
   cleanup:

.github/workflows/release-signed-artifacts.yml

@@ -7,7 +7,7 @@
 name: Release signed artifacts
 run-name: Generate release with signed artifacts for ${{ github.ref }}
 permissions:
-  contents: write
+  contents: write   # create GitHub Release and upload artifacts
 on:
   workflow_call:
     inputs:

.github/workflows/trivy-image-scan.yml

@@ -36,8 +36,8 @@ on:
         default: '1'
 
 permissions:
-  contents: read
-  security-events: write   # for SARIF upload to GHAS
+  contents: read          # baseline for checkout
+  security-events: write  # for SARIF upload to GHAS
 
 jobs:
   trivy:

.github/workflows/validate-rpm-quadlet.yml

@@ -18,6 +18,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read   # baseline for checkout
+
 jobs:
   parse:
     runs-on: ubuntu-latest