CPMSCFCORE-6629 read-only GITHUB_TOKEN compliance

.github/workflows/build.yaml

@@ -6,10 +6,14 @@ on:
     {}
   workflow_call:
     {}
+permissions:
+  contents: read
 jobs:
   build:
     name: Build Maven Project
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -37,6 +41,8 @@ jobs:
   system-tests:
     name: Execute system-tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -81,4 +87,4 @@ jobs:
           SERVICE_BINDING_LOCATION: ${{ github.workspace }}/validation/system-tests/service-key.json
           SETTINGS_APIKEY_LOCATION: ${{ github.workspace }}/validation/system-tests/service-config-api-key.json
           SETTINGS_X509_LOCATION: ${{ github.workspace }}/validation/system-tests/service-config-x509.json
-        run: mvn -B test --file pom.xml -pl :system-tests -Psystem-tests -am
+        run: mvn -B test --file pom.xml -pl :system-tests -Psystem-tests -am

.github/workflows/bump-version.yaml

@@ -16,10 +16,15 @@ on:
           - major
           - minor
           - patch
+permissions:
+  contents: read
 jobs:
   bump-version:
     name: Bump Version and write it back
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -84,4 +89,4 @@ jobs:
           git reset HEAD~1
           git add -u
           git commit -m "$BUMP_COMMIT_MESSAGE"
-          git push -f origin $BRANCH_NAME
+          git push -f origin $BRANCH_NAME

.github/workflows/perform-release.yaml

@@ -2,17 +2,25 @@ name: Perform release
 on:
   push:
     tags:  [ "v*" ]
+permissions:
+  contents: read
 jobs:
   build-client:
+    permissions:
+      contents: read
     uses: SAP/java-integration-for-sap-mobile-services/.github/workflows/build.yaml@main
     secrets: inherit
   release-docs:
+    permissions:
+      contents: write
     uses: SAP/java-integration-for-sap-mobile-services/.github/workflows/release-documentation.yaml@main
     secrets: inherit
   deploy-client:
     name: Deploy client to staging repo
     runs-on: ubuntu-latest
     environment: 'release'
+    permissions:
+      contents: read
     needs:
       - build-client
       - release-docs
@@ -39,4 +47,4 @@ jobs:
           MAVEN_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
           MAVEN_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-        run: mvn -B deploy --file pom.xml '-Possrh,!default' -Dgpg.passphrase="${GPG_PASSPHRASE}"
+        run: mvn -B deploy --file pom.xml '-Possrh,!default' -Dgpg.passphrase="${GPG_PASSPHRASE}"

.github/workflows/pr-voter.yaml

@@ -4,10 +4,14 @@ on:
     types: [ opened, reopened, synchronize ]
     branches:
       - main
+permissions:
+  contents: read
 jobs:
   rebase:
     name: (PR-Voter) Rebase project
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
         with:
@@ -28,6 +32,8 @@ jobs:
   build-maven:
     runs-on: ubuntu-latest
     name: (PR-Voter) Build Maven Project
+    permissions:
+      contents: read
     needs:
       - rebase
     steps:
@@ -45,6 +51,8 @@ jobs:
   build-docs:
     runs-on: ubuntu-latest
     name: (PR-Voter) Build Documentation
+    permissions:
+      contents: read
     needs:
       - rebase
     steps:

.github/workflows/prepare-patch-release.yaml

@@ -2,10 +2,14 @@ name: Prepare branch for a patch release
 on:
   workflow_dispatch:
     {}
+permissions:
+  contents: read
 jobs:
   prepare-patch-release:
     name: Create a release for a patch release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -59,4 +63,4 @@ jobs:
           git commit -m "$BUMP_COMMIT_MESSAGE"
           git checkout -b $BRANCH_NAME
           git push origin $BRANCH_NAME
-        working-directory: 'rel-branch'
+        working-directory: 'rel-branch'

.github/workflows/release-action.yaml

@@ -10,9 +10,13 @@ on:
         required: true
         description: The type of action (javascript, docker)
         type: string
+permissions:
+  contents: read
 jobs:
   build-action:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
         with:
@@ -40,6 +44,8 @@ jobs:
             !.github/actions/packages/${{ inputs.name }}/node_modules
   release-action:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     needs:
       - 'build-action'
     steps:
@@ -66,4 +72,4 @@ jobs:
           git tag -a "$ACTIONS_TAG" -m "$ACTIONS_TAG_MESSAGE" -f
           git remote rm origin
           git remote add origin "https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          git push -f origin refs/tags/$ACTIONS_TAG
+          git push -f origin refs/tags/$ACTIONS_TAG

.github/workflows/release-actions.yaml

@@ -6,23 +6,33 @@ on:
       - 'main'
     paths:
       - '.github/actions/**/*'
+permissions:
+  contents: read
 jobs:
   publish-bump-version-action:
+    permissions:
+      contents: write
     uses: SAP/java-integration-for-sap-mobile-services/.github/workflows/release-action.yaml@main
     with:
       name: 'bump-version'
       type: 'javascript'
   publish-build-mkdocs-action:
+    permissions:
+      contents: write
     uses: SAP/java-integration-for-sap-mobile-services/.github/workflows/release-action.yaml@main
     with:
       name: 'build-mkdocs'
       type: 'docker'
   publish-is-latest-release-action:
+    permissions:
+      contents: write
     uses: SAP/java-integration-for-sap-mobile-services/.github/workflows/release-action.yaml@main
     with:
       name: 'is-latest-release'
       type: 'javascript'
   publish-prepare-mobile-services-app-action:
+    permissions:
+      contents: write
     uses: SAP/java-integration-for-sap-mobile-services/.github/workflows/release-action.yaml@main
     with:
       name: 'prepare-mobile-services-app'

.github/workflows/release-documentation.yaml

@@ -6,10 +6,14 @@ on:
       - main
   workflow_call:
     {}
+permissions:
+  contents: read
 jobs:
   build-documentation:
     runs-on: ubuntu-latest
     name: Build Documentation
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -53,6 +57,8 @@ jobs:
   build-javadoc:
     runs-on: ubuntu-latest
     name: Build JavaDoc
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -75,6 +81,8 @@ jobs:
     runs-on: ubuntu-latest
     name: Publish Documentation to GH-Pages
     concurrency: 'publish_docs'
+    permissions:
+      contents: write
     needs:
       - 'build-documentation'
       - 'build-javadoc'

.github/workflows/trigger-release.yaml

@@ -2,10 +2,14 @@ name: Trigger release procedure
 on:
   workflow_dispatch:
     {}
+permissions:
+  contents: read
 jobs:
   create-release-tag:
     name: Create a Release Tag
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -51,8 +55,10 @@ jobs:
     needs:
       - create-release-tag
     if: github.ref == 'refs/heads/main'
+    permissions:
+      contents: write
+      pull-requests: write
     uses: SAP/java-integration-for-sap-mobile-services/.github/workflows/bump-version.yaml@main
     with:
       type: minor
-    secrets: inherit
-
+    secrets: inherit