GH Actions: set permissions for each workflow/job

.github/workflows/basic-qa.yml

@@ -13,18 +13,30 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   yamllint:
+    permissions:
+      contents: read # To clone the repo.
+
     name: 'Lint Yaml'
     uses: PHPCSStandards/.github/.github/workflows/reusable-yamllint.yml@c535983699986d1c538d4e47f33e813fcfbcc8a0 # v1.2.2
     with:
       strict: true
 
   markdownlint:
+    permissions:
+      contents: read # To clone the repo.
+
     name: 'Lint Markdown'
     uses: PHPCSStandards/.github/.github/workflows/reusable-markdownlint.yml@c535983699986d1c538d4e47f33e813fcfbcc8a0 # v1.2.2
 
   linkcheck:
+    permissions:
+      contents: read # To clone the repo.
+
     name: "Check links"
     runs-on: ubuntu-latest
 
@@ -52,6 +64,9 @@ jobs:
           fail: true
 
   spellcheck:
+    permissions:
+      contents: read # To clone the repo.
+
     # Config file: .cspell.yml
 
     name: Spellcheck
@@ -79,6 +94,9 @@ jobs:
           incremental_files_only: false
 
   shellcheck:
+    permissions:
+      contents: read # To clone the repo.
+
     name: 'ShellCheck'
     runs-on: ubuntu-latest
 

.github/workflows/label-merge-conflicts.yml

@@ -12,8 +12,14 @@ on:
       - synchronize
       - reopened
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   check-prs:
+    permissions:
+      pull-requests: write # To add and remove PR labels.
+
     if: github.repository_owner == 'PHPCSStandards'
 
     name: Check PRs for merge conflicts

.github/workflows/label-new-prs.yml

@@ -16,8 +16,14 @@ on:
       - '.github/workflows/label-new-prs.yml'
       - '.github/labeler.yml'
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   label-new-prs:
+    permissions:
+      pull-requests: write # To add PR labels.
+
     if: github.repository_owner == 'PHPCSStandards' && github.event_name == 'pull_request_target'
 
     name: Add labels to new PRs
@@ -30,6 +36,9 @@ jobs:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
   validate-labeler-worflow:
+    permissions:
+      contents: read # To clone the repo.
+
     if: github.repository_owner == 'PHPCSStandards' && github.event_name == 'pull_request' && github.event.pull_request.merged == false
 
     name: Validate changes to Labeler logic

.github/workflows/label-remove-outdated.yml

@@ -10,8 +10,14 @@ on:
       - closed
       - review_requested
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   on-issue-close:
+    permissions:
+      issues: write # To remove issue labels.
+
     if: github.repository_owner == 'PHPCSStandards' && github.event.issue.state == 'closed'
 
     name: Clean up labels on issue close
@@ -29,6 +35,9 @@ jobs:
             Status: triage
 
   on-pr-review-request:
+    permissions:
+      pull-requests: write # To remove PR labels.
+
     if: github.repository_owner == 'PHPCSStandards' && github.event.action == 'review_requested'
 
     name: "Clean up labels on PR (re-)review request"
@@ -42,6 +51,9 @@ jobs:
             Status: awaiting feedback
 
   on-pr-merge:
+    permissions:
+      pull-requests: write # To remove PR labels.
+
     if: github.repository_owner == 'PHPCSStandards' && github.event.pull_request.merged == true
 
     name: Clean up labels on PR merge
@@ -61,6 +73,9 @@ jobs:
             Status: wait for PHPCS 4.0.0 release
 
   on-pr-close:
+    permissions:
+      pull-requests: write # To remove PR labels.
+
     # yamllint disable-line rule:line-length
     if: github.repository_owner == 'PHPCSStandards' && github.event_name == 'pull_request_target' && github.event.action == 'closed' && github.event.pull_request.merged == false
 

.github/workflows/pr-comment.yml

@@ -12,17 +12,19 @@ concurrency:
   # or the commit hash for any other events.
   group: ${{ github.workflow }}-${{ github.sha }}
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   artifact-review-comment:
+    permissions:
+      pull-requests: write # To add the PR comment.
+
     if: >
       github.repository == 'PHPCSStandards/PHP_CodeSniffer-documentation' &&
       github.event.workflow_run.event == 'pull_request' &&
       github.event.workflow_run.conclusion == 'success'
 
-    permissions:
-      # Needed for the PR comment.
-      pull-requests: write
-
     name: Comment on a pull request
     runs-on: ubuntu-latest
 

.github/workflows/publish-wiki.yml

@@ -30,11 +30,13 @@ concurrency:
   group: "publish-wiki"
   cancel-in-progress: false
 
+# Permissions should be configured at the job level.
+permissions: {}
+
 jobs:
   publish-wiki:
     permissions:
-      # Needed for the commit to the wiki.
-      contents: write
+      contents: write # To clone the repo and commit to the wiki.
 
     if: github.repository == 'PHPCSStandards/PHP_CodeSniffer-documentation'