fix(NoTicket): harden CI checkouts and workflow permissions

.github/workflows/build-documentation.yml

@@ -11,6 +11,9 @@ on:
     types:
       - created
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

.github/workflows/check-pr-formatting.yml

@@ -5,6 +5,9 @@ on:
     branches: [ main, 0.x ]
     types: [opened, synchronize, edited]
 
+permissions:
+  contents: read
+
 jobs:
   pr-formatting:
     runs-on: ubuntu-slim

.github/workflows/code-check.yml

@@ -2,22 +2,23 @@ name: Code quality checks
 
 on:
   workflow_call:
-    inputs:
-      branch:
-        required: false
-        type: string
-        description: 'Branch to run on'
   push:
     branches: [ main, 0.x ]
 
+permissions:
+  contents: read
+
 jobs:
   check-code:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    cache-mode: none
     steps:
     - name: Check out code
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
-        ref: ${{ inputs.branch }}
+        persist-credentials: false
 
     - name: Set up Python 3.10
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

.github/workflows/integration-tests-core.yml

@@ -41,6 +41,10 @@ on:
     secrets:
       SLACK_BOT_TOKEN:
         required: false
+
+permissions:
+  contents: read
+
 jobs:
   run-core-integration-tests:
     permissions:

.github/workflows/integration-tests-v2.yml

@@ -14,6 +14,9 @@ on:
         type: string
         default: ''
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     permissions:

.github/workflows/integration-tests.yml

@@ -7,6 +7,10 @@ on:
         required: true
       FIREBOLT_CLIENT_SECRET_STG_NEW_IDN:
         required: true
+
+permissions:
+  contents: read
+
 jobs:
   integration-test-v2:
     uses: ./.github/workflows/integration-tests-v2.yml
@@ -16,6 +20,8 @@ jobs:
   integration-test-core:
     uses: ./.github/workflows/integration-tests-core.yml
   report-test-results:
+    permissions:
+      statuses: write
     needs: [integration-test-v2, integration-test-core]
     if: always()
     runs-on: ubuntu-latest

.github/workflows/nightly-v2.yml

@@ -3,6 +3,10 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '0 3 * * *' # 3 am UTC every day
+
+permissions:
+  contents: read
+
 jobs:
   code-check:
     uses: ./.github/workflows/code-check.yml
@@ -11,6 +15,9 @@ jobs:
     secrets:
       GIST_PAT: ${{ secrets.GIST_PAT }}
   security-scan:
+    permissions:
+      contents: read
+      pull-requests: read
     needs: [unit-tests]
     uses: ./.github/workflows/security-scan.yml
     secrets:

.github/workflows/pull-request.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ main, 0.x ]
 
+permissions:
+  contents: read
+
 jobs:
   code-checkers:
     uses: ./.github/workflows/code-check.yml
@@ -13,6 +16,9 @@ jobs:
       GIST_PAT: ${{ secrets.GIST_PAT }}
 
   security-scan:
+    permissions:
+      contents: read
+      pull-requests: read
     needs: [unit-tests]
     uses: ./.github/workflows/security-scan.yml
     secrets:

.github/workflows/release.yml

@@ -10,8 +10,14 @@ on:
         required: false
         description: 'Trigger a major release (optional). Leave empty for regular release.'
 
+permissions:
+  contents: read
+
 jobs:
   integration-tests:
+    permissions:
+      contents: read
+      statuses: write
     uses: ./.github/workflows/integration-tests.yml
     secrets:
       FIREBOLT_CLIENT_ID_STG_NEW_IDN: ${{ secrets.FIREBOLT_CLIENT_ID_STG_NEW_IDN }}

.github/workflows/security-scan.yml

@@ -3,25 +3,24 @@ name: Firebolt Security Scan
 on:
   workflow_dispatch:
   workflow_call:
-    inputs:
-      branch:
-        required: false
-        type: string
-        description: 'Branch to run on'
     secrets:
       FOSSA_TOKEN:
         required: true
       SONARCLOUD_TOKEN:
         required: true
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   security-scan:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout Code"
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          ref: ${{ inputs.branch }}
+          persist-credentials: false
 
       - name: "Download coverage report"
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1

.github/workflows/unit-tests.yml

@@ -5,17 +5,15 @@ name: Unit tests
 
 on:
   workflow_call:
-    inputs:
-      branch:
-        required: false
-        type: string
-        description: 'Branch to run on'
     secrets:
       GIST_PAT:
         required: true
   push:
     branches: [ main, 0.x ]
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests:
     runs-on: ubuntu-latest
@@ -25,7 +23,7 @@ jobs:
     - name: Check out code
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
-        ref: ${{ inputs.branch }}
+        persist-credentials: false
 
     - name: Set up Python 3.10
       uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0