chore(ci): harden workflow permissions for security compliance (#4898)

Author: dreamorosi

.github/workflows/layers_partitions.yml

@@ -37,8 +37,7 @@ on:
 name: Layer Deployment (Partitions)
 run-name: Layer Deployment (${{ inputs.partition }})
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   # This job configures partition-specific settings including regions, partition names, and STS audience based on the target partition (China or GovCloud) selected in the workflow inputs.
@@ -108,6 +107,9 @@ jobs:
   deploy-gamma:
     name: Deploy Gamma Layer
     needs: [setup, download]
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/layers_partitions_deploy.yml
     with:
       environment: Gamma
@@ -120,6 +122,9 @@ jobs:
   deploy-prod:
     name: Deploy Prod Layer
     needs: [setup, download, deploy-gamma]
+    permissions:
+      id-token: write
+      contents: read
     uses: ./.github/workflows/layers_partitions_deploy.yml
     with:
       environment: Prod

.github/workflows/layers_partitions_deploy.yml

@@ -1,5 +1,7 @@
 name: Copy Layer
 
+permissions: {}
+
 on:
   workflow_call:
     inputs:

.github/workflows/ossf_scorecard.yml

@@ -9,14 +9,15 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions: read-all
+permissions: {}
 
 jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     # environment: scorecard
     permissions:
+      contents: read  # checkout repository
       security-events: write  # update code-scanning dashboard
       id-token: write  # confirm org+repo identity before publish results
 

.github/workflows/publish_layer.yml

@@ -1,7 +1,6 @@
 name: Deploy layer to all regions
 
-permissions:
-  contents: read
+permissions: {}
 
 on:
   # Manual trigger
@@ -32,6 +31,8 @@ on:
 jobs:
   # Build layer by running cdk synth in layer-publisher directory and uploading cdk.out for deployment
   build-layer:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     if: ${{ (github.event.workflow_run.conclusion == 'success') || (github.event_name == 'workflow_dispatch') }}
     steps:

.github/workflows/quality_check.yml

@@ -9,11 +9,12 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   code-quality:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
@@ -52,6 +53,8 @@ jobs:
           npm run test:unit:coverage -w ${{ matrix.workspace }}
           npm run test:unit:types -w ${{ matrix.workspace }}
   check-examples:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
@@ -77,6 +80,8 @@ jobs:
       - name: Run tests
         run: npm t
   check-layer-publisher:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
@@ -95,6 +100,8 @@ jobs:
       - name: Run tests
         run: npm run test:unit -w layers
   check-docs-snippets:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
@@ -111,6 +118,8 @@ jobs:
       - name: Run linting
         run: npm run lint -w examples/snippets
   check-docs:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev

.github/workflows/reusable-run-linting-check-and-unit-tests.yml

@@ -29,11 +29,12 @@ name: Run unit tests
 on:
   workflow_call:
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   code-quality:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
@@ -74,6 +75,8 @@ jobs:
           npm run test:unit:coverage -w ${{ matrix.workspace }}
           npm run test:unit:types -w ${{ matrix.workspace }}
   check-examples:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
@@ -102,6 +105,8 @@ jobs:
       - name: Run tests
         run: npm t
   check-layer-publisher:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
@@ -114,6 +119,8 @@ jobs:
       - name: Run tests
         run: npm run test:unit -w layers
   check-docs-snippets:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
@@ -124,6 +131,8 @@ jobs:
       - name: Run linting
         run: npm run lint:ci -w examples/snippets
   check-docs:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev