ci: test using no permissions by default for most CI jobs + bump setup-python (#2025)

* ci: test using no permissions by default for most CI jobs

* Also require production approval for a release upload

* remove build_release individual 'job'

* tweak some stuff

* driveby bump on setup-python to 6.2.0 to fix node20 warnings

* remove bsd vm check name

.github/workflows/bsd_vm_check.yml

@@ -1,7 +1,5 @@
 # Run BSD VM jobs with manually-implemented retries.
 
-name: "BSD VM Check"
-
 on:
   workflow_call:
     inputs:
@@ -14,6 +12,8 @@ on:
         description: "Release version"
         required: true
 
+permissions: {}
+
 # Duplicated because GHA doesn't support passing env vars through without making them all inputs or something.
 env:
   RUST_BACKTRACE: 1

.github/workflows/build_releases.yml

@@ -10,10 +10,7 @@
 # TODO: Break this up into scripts instead.
 # TODO: Trigger this in CI as well if this file changes, so I don't have to spam nightly builds.
 
-name: "build releases"
-
 on:
-  workflow_dispatch:
   workflow_call:
     inputs:
       caller:

.github/workflows/ci.yml

@@ -16,6 +16,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 env:
   RUST_BACKTRACE: 1
   CARGO_INCREMENTAL: 0

.github/workflows/clear_workflow_cache.yml

@@ -15,6 +15,8 @@ on:
   schedule:
     - cron: "0 11 * * 0"
 
+permissions: {}
+
 jobs:
   clear-cache:
     if: ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }} # If it is a PR, only if not a fork

.github/workflows/coverage.yml

@@ -12,6 +12,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_HUSKY_DONT_INSTALL_HOOKS: true

.github/workflows/deployment.yml

@@ -12,6 +12,11 @@ on:
     tags:
       - "[0-9]+.[0-9]+.[0-9]+"
 
+permissions:
+  id-token: write
+  contents: read
+  attestations: write
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_PROFILE_DEV_DEBUG: 0
@@ -91,6 +96,7 @@ jobs:
     name: upload-release
     runs-on: ubuntu-24.04
     needs: [initialize, generate-choco, build-release]
+    environment: production
     steps:
       - name: Set release version
         shell: bash

.github/workflows/docs.yml

@@ -18,6 +18,10 @@ on:
       - "docs/**"
       - ".github/workflows/docs.yml"
 
+permissions:
+  pages: write
+  id-token: write
+
 env:
   # Assign commit authorship to official GitHub Actions bot when pushing to the `gh-pages` branch:
   GIT_USER: "github-actions[bot]"
@@ -33,7 +37,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12
 

.github/workflows/nightly.yml

@@ -14,6 +14,12 @@ on:
         required: false
         type: boolean
 
+permissions:
+  id-token: write
+  contents: read
+  attestations: write
+  pages: write
+
 env:
   CARGO_INCREMENTAL: 0
   CARGO_PROFILE_DEV_DEBUG: 0

.github/workflows/post_release.yml

@@ -13,6 +13,10 @@ on:
         description: "Which tag to deploy as:"
         required: true
 
+permissions:
+  pages: write
+  id-token: write
+
 env:
   # Assign commit authorship to official GitHub Actions bot when pushing to the `gh-pages` branch:
   GIT_USER: "github-actions[bot]"
@@ -59,7 +63,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12
 

.github/workflows/test_docs.yml

@@ -6,6 +6,8 @@ on:
   workflow_dispatch:
   pull_request:
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'ClementTsang/bottom' }}
@@ -34,7 +36,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12
 

.github/workflows/validate_schema.yml

@@ -1,6 +1,7 @@
 # Workflow to validate the latest schema.
 
 name: "validate schema"
+
 on:
   workflow_dispatch:
   pull_request:
@@ -14,6 +15,8 @@ on:
       - "src/bin/schema.rs"
       - "Cargo.toml"
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' || github.repository != 'ClementTsang/bottom' }}
@@ -42,7 +45,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.12