From 731564b65692e36754f3cb831d7afa071d7ac99f Mon Sep 17 00:00:00 2001
From: Clement Tsang <34804052+ClementTsang@users.noreply.github.com>
Date: Sat, 11 Apr 2026 17:48:58 -0400
Subject: [PATCH] ci: test using no permissions by default for most CI jobs +
 bump setup-python (#2025)

* ci: test using no permissions by default for most CI jobs

* Also require production approval for a release upload

* remove build_release individual 'job'

* tweak some stuff

* driveby bump on setup-python to 6.2.0 to fix node20 warnings

* remove bsd vm check name
---
 .github/workflows/bsd_vm_check.yml         | 4 ++--
 .github/workflows/build_releases.yml       | 3 ---
 .github/workflows/ci.yml                   | 2 ++
 .github/workflows/clear_workflow_cache.yml | 2 ++
 .github/workflows/coverage.yml             | 2 ++
 .github/workflows/deployment.yml           | 6 ++++++
 .github/workflows/docs.yml                 | 6 +++++-
 .github/workflows/nightly.yml              | 6 ++++++
 .github/workflows/post_release.yml         | 6 +++++-
 .github/workflows/test_docs.yml            | 4 +++-
 .github/workflows/validate_schema.yml      | 5 ++++-
 11 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/bsd_vm_check.yml b/.github/workflows/bsd_vm_check.yml
index 81088f1d..ed6e307b 100644
--- a/.github/workflows/bsd_vm_check.yml
+++ b/.github/workflows/bsd_vm_check.yml
@@ -1,7 +1,5 @@
 # Run BSD VM jobs with manually-implemented retries.
 
-name: "BSD VM Check"
-
 on:
   workflow_call:
     inputs:
@@ -14,6 +12,8 @@ on:
         description: "Release version"
         required: true
 
+permissions: {}
+
 # Duplicated because GHA doesn't support passing env vars through without making them all inputs or something.
 env:
   RUST_BACKTRACE: 1
diff --git a/.github/workflows/build_releases.yml b/.github/workflows/build_releases.yml
index ffcb42ce..c747e81c 100644
--- a/.github/workflows/build_releases.yml
+++ b/.github/workflows/build_releases.yml
@@ -10,10 +10,7 @@
 # TODO: Break this up into scripts instead.
 # TODO: Trigger this in CI as well if this file changes, so I don't have to spam nightly builds.
 
-name: "build releases"
-
 on:
-  workflow_dispatch:
   workflow_call:
     inputs:
       caller:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e64f5053..e1beb237 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 env:
   RUST_BACKTRACE: 1
   CARGO_INCREMENTAL: 0
diff --git a/.github/workflows/clear_workflow_cache.yml b/.github/workflows/clear_workflow_cache.yml
index 6057eaf3..5891f8df 100644
--- a/.github/workflows/clear_workflow_cache.yml
+++ b/.github/workflows/clear_workflow_cache.yml
@@ -15,6 +15,8 @@ on:
   schedule:
     - cron: "0 11 * * 0"
 
+permissions: {}
+
 jobs:
   clear-cache:
     if: ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }} # If it is a PR, only if not a fork
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index f04e4ea4..9a43c548 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -12,6 +12,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_HUSKY_DONT_INSTALL_HOOKS: true
diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
index a92f8a20..4295a1f2 100644
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -12,6 +12,11 @@ on:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
 
+permissions:
+  id-token: write
+  contents: read
+  attestations: write
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_PROFILE_DEV_DEBUG: 0
@@ -91,6 +96,7 @@ jobs:
     name: upload-release
     runs-on: ubuntu-24.04
     needs: [initialize, generate-choco, build-release]
+    environment: production
     steps:
       - name: Set release version
         shell: bash
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 0dd953f9..362db0b2 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -18,6 +18,10 @@ on:
       - "docs/**"
       - ".github/workflows/docs.yml"
 
+permissions:
+  pages: write
+  id-token: write
+
 env:
   # Assign commit authorship to official GitHub Actions bot when pushing to the `gh-pages` branch:
   GIT_USER: "github-actions[bot]"
@@ -33,7 +37,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 8dcab727..27f2bf3e 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -14,6 +14,12 @@ on:
         required: false
         type: boolean
 
+permissions:
+  id-token: write
+  contents: read
+  attestations: write
+  pages: write
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_PROFILE_DEV_DEBUG: 0
diff --git a/.github/workflows/post_release.yml b/.github/workflows/post_release.yml
index 9cb62496..046b3ae9 100644
--- a/.github/workflows/post_release.yml
+++ b/.github/workflows/post_release.yml
@@ -13,6 +13,10 @@ on:
         description: "Which tag to deploy as:"
         required: true
 
+permissions:
+  pages: write
+  id-token: write
+
 env:
   # Assign commit authorship to official GitHub Actions bot when pushing to the `gh-pages` branch:
   GIT_USER: "github-actions[bot]"
@@ -59,7 +63,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/test_docs.yml b/.github/workflows/test_docs.yml
index c8abcf1d..afd95756 100644
--- a/.github/workflows/test_docs.yml
+++ b/.github/workflows/test_docs.yml
@@ -6,6 +6,8 @@ on:
   workflow_dispatch:
   pull_request:
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'ClementTsang/bottom' }}
@@ -34,7 +36,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/validate_schema.yml b/.github/workflows/validate_schema.yml
index 8733bcb5..17664328 100644
--- a/.github/workflows/validate_schema.yml
+++ b/.github/workflows/validate_schema.yml
@@ -1,6 +1,7 @@
 # Workflow to validate the latest schema.
 
 name: "validate schema"
+
 on:
   workflow_dispatch:
   pull_request:
@@ -14,6 +15,8 @@ on:
       - "src/bin/schema.rs"
       - "Cargo.toml"
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'ClementTsang/bottom' }}
@@ -42,7 +45,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12