[ashishkurmi]

Description

This PR adds minimum token permissions for the GITHUB_TOKEN in GitHub Actions workflows using https://github.com/step-security/secure-workflows.

The GitHub Actions workflow has a GITHUB_TOKEN with write access to multiple scopes.
Here is an example of the permissions in one of the workflow runs:
https://github.com/python/mypy/runs/8253080028?check_suite_focus=true#step:1:19

After this change, the scopes will be reduced to the minimum needed for the following workflows:

• build_wheels.yml
• docs.yml
• mypy_primer.yml
• test.yml
• test_stubgenc.yml

The following workflow already has the least privileged token permission set:

• mypy_primer_comment.yml

Motivation and Context

• This is a security best practice, so if the GITHUB_TOKEN is compromised due to a vulnerability or compromised Action, the damage will be reduced.
• GitHub recommends defining minimum GITHUB_TOKEN permissions.
  https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
• The Open Source Security Foundation (OpenSSF) Scorecards also treats not setting token permissions as a high-risk issue. This change will help increase the Scorecard score for this repository.

Signed-off-by: Ashish Kurmi akurmi@stepsecurity.io

[sobolevn]

I like the idea. Stronger security is always a good thing.

[sobolevn]

It duplicates these lines https://github.com/python/mypy/pull/13645/files#diff-1d3e91c57336ce4ff8a9d5762ddc5ffa66f99f0afb918aab0b02e53db80bf54cR25

[ashishkurmi]

Hello @sobolevn, I analyzed all of the workflows included in the project and found that they only need contents:read to function hence I added it on all workflow files.

[sobolevn]

We don't need these lines anymore: https://github.com/python/mypy/pull/13645/files#diff-1d3e91c57336ce4ff8a9d5762ddc5ffa66f99f0afb918aab0b02e53db80bf54cR25-R26

[sobolevn]

Maybe there are other places where we already have permissions: set?

[ashishkurmi]

@sobolevn yes, mypy_primer_comment.yml already has token permission set hence I did not include it in the PR. This change will increase the security of other workflow files.

[github-actions]

According to mypy_primer, this change has no effect on the checked open source code. 🤖🎉

[ashishkurmi]

Thanks for reviewing the PR @sobolevn ! I just addressed your comment, please take a look when you get a chance.

[hauntsaninja]

Thanks, I think fixed in #15965