Backport workflow-hardening fix (excessive-permissions) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/backport.yaml, .github/workflows/check_pr_labels.yaml, .github/workflows/cleanup.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 6507cd6

Affected release branches (5)

• release/2.9.x (still present as of HEAD 80da0954)
• release/2.11.x (still present as of HEAD aae23d46)
• release/2.12.x (still present as of HEAD 8e3d9d01)
• release/2.10.x (still present as of HEAD cbf04aea)
• release/2.5.x (still present as of HEAD 08c0f75a)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release/2.9.x — excessive-permissions

File .github/workflows/check_pr_labels.yaml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/check_pr_labels.yaml
+++ b/.github/workflows/check_pr_labels.yaml
@@ -14,3 +14,5 @@
           invalid-labels: 'do not merge,on-hold'
           pull-request-number: '${{ github.event.pull_request.number }}'
           disable-reviews: true
+permissions:
+  contents: read

release/2.11.x — excessive-permissions

File .github/workflows/backport.yaml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.pull-requests = 'write'
• • permissions.contents = 'read'

--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -24,3 +24,8 @@
       - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
+    permissions:
+      contents: write
+      pull-requests: write
+permissions:
+  contents: read

release/2.12.x — excessive-permissions

File .github/workflows/backport.yaml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.pull-requests = 'write'
• • permissions.contents = 'read'

--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -24,3 +24,8 @@
       - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2.0.4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
+    permissions:
+      contents: write
+      pull-requests: write
+permissions:
+  contents: read

release/2.10.x — excessive-permissions

File .github/workflows/backport.yaml; suggested edits:

• • jobs.$J.permissions.contents = 'write'
• • jobs.$J.permissions.pull-requests = 'write'
• • permissions.contents = 'read'

--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -24,3 +24,8 @@
       - uses: tibdex/backport@9565281eda0731b1d20c4025c43339fb0a23812e # v2
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
+    permissions:
+      contents: write
+      pull-requests: write
+permissions:
+  contents: read

release/2.5.x — excessive-permissions

File .github/workflows/cleanup.yaml; suggested edits:

• • permissions.contents = 'read'

--- a/.github/workflows/cleanup.yaml
+++ b/.github/workflows/cleanup.yaml
@@ -34,3 +34,5 @@
           GOOGLE_APPLICATION_CREDENTIALS: ${{ secrets.GOOGLE_APPLICATION_CREDENTIALS }}
           GOOGLE_PROJECT: ${{ secrets.GOOGLE_PROJECT }}
           GOOGLE_LOCATION: ${{ secrets.GOOGLE_LOCATION }}
+permissions:
+  contents: read

---

Happy to open pull requests instead if that's preferred.