feat: harden permissions for all github workflows

Signed-off-by: Joyce Brum <joycebrum@google.com>

Reviewed By: tstellar

Differential Revision: https://reviews.llvm.org/D144119

.github/workflows/clang-tests.yml

@@ -1,5 +1,8 @@
 name: Clang Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:

.github/workflows/closed-issues.yml

@@ -3,8 +3,14 @@ on:
   issues:
     types: ['closed']
 
+permissions:
+  contents: read
+
 jobs:
   automate-issues-labels:
+    permissions:
+      issues: write  # for andymckay/labeler to label issues
+      pull-requests: write  # for andymckay/labeler to label PRs
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:

.github/workflows/issue-release-workflow.yml

@@ -14,6 +14,9 @@
 
 name: Issue Release Workflow
 
+permissions:
+  contents: read
+
 on:
   issue_comment:
     types:

.github/workflows/issue-subscriber.yml

@@ -5,6 +5,9 @@ on:
     types:
       - labeled
 
+permissions:
+  contents: read
+
 jobs:
   auto-subscribe:
     runs-on: ubuntu-latest

.github/workflows/libclang-abi-tests.yml

@@ -1,5 +1,8 @@
 name: libclang ABI Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:

.github/workflows/libclc-tests.yml

@@ -1,5 +1,8 @@
 name: libclc Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:

.github/workflows/lld-tests.yml

@@ -1,5 +1,8 @@
 name: LLD Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:

.github/workflows/lldb-tests.yml

@@ -1,5 +1,8 @@
 name: lldb Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:

.github/workflows/llvm-bugs.yml

@@ -1,5 +1,9 @@
 name: LLVM Bugs notifier
 
+permissions:
+  contents: read
+  issues: read
+
 on:
   issues:
     types:

.github/workflows/llvm-project-tests.yml

@@ -1,5 +1,8 @@
 name: LLVM Project Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:

.github/workflows/llvm-tests.yml

@@ -1,5 +1,8 @@
 name: LLVM Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:

.github/workflows/new-issues.yml

@@ -3,8 +3,14 @@ on:
   issues:
     types: ['opened']
 
+permissions:
+  contents: read
+
 jobs:
   automate-issues-labels:
+    permissions:
+      issues: write  # for andymckay/labeler to label issues
+      pull-requests: write  # for andymckay/labeler to label PRs
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:

.github/workflows/release-tasks.yml

@@ -1,5 +1,8 @@
 name: Release Task
 
+permissions:
+  contents: read
+
 on:
   push:
     tags:
@@ -8,6 +11,8 @@ on:
 
 jobs:
   release-tasks:
+    permissions:
+      contents: write # To upload assets to release.
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:

.github/workflows/version-check.yml

@@ -8,6 +8,9 @@ on:
     branches:
       - 'release/**'
 
+permissions:
+  contents: read
+
 jobs:
   version_check:
     if: github.repository_owner == 'llvm'