GHA: document permissions as required by zizmor 1.13.0

Ref: https://github.com/zizmorcore/zizmor/pull/1131
Ref: https://docs.zizmor.sh/audits/#undocumented-permissions

Bug: https://github.com/curl/curl/pull/18539#issuecomment-3288151910

Closes #18541

diff --git a/.github/workflows/appveyor-status.yml b/.github/workflows/appveyor-status.yml
index cb7f96b1907eed3d5e77f1a1c7213b0423ec7de2..5269f3ca65b97ffbdbe7cc6c3c8576bcee4630d3 100644 (file)
--- a/.github/workflows/appveyor-status.yml
+++ b/.github/workflows/appveyor-status.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event.sender.login == 'appveyor[bot]' }}
     permissions:
-      statuses: write
+      statuses: write  # To update build statuses
     steps:
       - name: 'Create individual AppVeyor build statuses'
         if: ${{ github.event.sha && github.event.target_url }}

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0952eb3d1d2281d1ab0b544b4c508087e4325e9d..ff2e91c32a421170faba97df3fd0b4e097879e44 100644 (file)
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -45,7 +45,7 @@ jobs:
     name: 'GHA and Python'
     runs-on: ubuntu-latest
     permissions:
-      security-events: write
+      security-events: write  # To create/update security events
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
@@ -64,7 +64,7 @@ jobs:
     name: 'C'
     runs-on: ubuntu-latest
     permissions:
-      security-events: write
+      security-events: write  # To create/update security events
     steps:
       - name: 'install prereqs'
         timeout-minutes: 5

diff --git a/.github/workflows/hacktoberfest-accepted.yml b/.github/workflows/hacktoberfest-accepted.yml
index 916b354481cab55b1743903bcc6a97854f023f01..3aacbd6d0c5c390a24dce1be5e008f90c98d9ba3 100644 (file)
--- a/.github/workflows/hacktoberfest-accepted.yml
+++ b/.github/workflows/hacktoberfest-accepted.yml
@@ -23,9 +23,8 @@ jobs:
     name: 'Add hacktoberfest-accepted label'
     runs-on: ubuntu-latest
     permissions:
-      # requires issues AND pull-requests write permissions to edit labels on PRs!
-      issues: write
-      pull-requests: write
+      issues: write          # To edit labels on PRs
+      pull-requests: write   # To edit labels on PRs
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
         with:

diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index b84702a8a1b96feaa1101274054b8034eeb31d3c..cfafde14f7fed36173f5f28757ac2a20634f6a37 100644 (file)
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -19,8 +19,8 @@ jobs:
     name: 'Labeler'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      pull-requests: write
+      contents: read        # To comply with https://github.com/actions/labeler documentation
+      pull-requests: write  # To edit labels on PRs
 
     steps:
       - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6