chore: secure workflows permission

[ddevsr]

Description
Ref: twbs/bootstrap#36325 PHP-CS-Fixer/PHP-CS-Fixer#6644

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[datamweb]

bcit-ci/CodeIgniter#6155

[kenjis]

Please add top-level permissions:.

[ddevsr]

permissions: in top-level will cover permission all jobs, And i think no need set permission per job when top-level already write exclude job check-version must set permission: read. Agree?

[kenjis]

I think generally we should set top-level permissions: read only.
Top level permissions: is the default, and it can be overridden in jobs.

I don't know the default setting of this organization. So if it is read write permissions, jobs without permission can write. It is not safe to supply chain attacks.

[ddevsr]

You can set default permission in organization, open https://github.com/organizations/codeigniter4/settings/actions and find Workflow permissions in bottom

[kenjis]

I have no permission to access the URL.

[kenjis]

Yes.

[ddevsr]

or only owner this organization can access this setting

[MGatner]

Yes I have access, though I'm hesitant to make changes until we have the necessary write permissions in place everywhere first.

[paulbalandan]

Default org permission should be read-only. Adding write permissions should be done on a per-workflow or per-job basis only.

[hexageek1337]

Yes, said @paulbalandan, and we must not forget that one day if we want to change permissions at the organizational level, we must include permission read at the top-level.

Btw, i am @ddevsr. Waiting review recovery account.

[kenjis]

SCSS error was fixed. Please rebase when you update.

[MGatner]

Thanks for spearheading this! I will have to read more in depth on the individual permissions and scopes. Please address @kenjis' questions in the meantime.

[MGatner]

Do we still need all the "contents: read" directives once the org change is made?

[kenjis]

Do we still need all the "contents: read" directives once the org change is made?

Yes. If we would change the org setting accidentally or by any reason, all GA flows will have write permissions.

[MGatner]

Organization repository workflow permissions have been set to "read". Please keep an eye on these workflow runs over the next few days.