Revert "Remove (hopefully) unnecessary workflow lines (#13241)"

This reverts commit 1aea455.

Author: trask

.github/workflows/build-daily-no-build-cache.yml

@@ -39,6 +39,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - common

.github/workflows/build-daily.yml

@@ -42,6 +42,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - common

.github/workflows/codeql.yml

@@ -26,6 +26,7 @@ permissions:
 jobs:
   analyze:
     permissions:
+      contents: read
       actions: read  # for github/codeql-action/init to get workflow details
       security-events: write  # for github/codeql-action/analyze to upload SARIF results
     runs-on: otel-linux-latest-8-cores

.github/workflows/issue-management-feedback-label.yml

@@ -10,6 +10,7 @@ permissions:
 jobs:
   issue_comment:
     permissions:
+      contents: read
       issues: write
     if: >
       contains(github.event.issue.labels.*.name, 'needs author feedback') &&

.github/workflows/issue-management-stale-action.yml

@@ -11,6 +11,7 @@ permissions:
 jobs:
   stale:
     permissions:
+      contents: read
       issues: write  # for actions/stale to close stale issues
       pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-latest

.github/workflows/label.yml

@@ -8,6 +8,7 @@ jobs:
   label:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       pull-requests: write
     steps:
     - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0

.github/workflows/native-tests-daily.yml

@@ -17,6 +17,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - graalvm-native-tests

.github/workflows/overhead-benchmark-daily.yml

@@ -56,6 +56,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - run-overhead-tests

.github/workflows/owasp-dependency-check-daily.yml

@@ -44,6 +44,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - analyze

.github/workflows/publish-petclinic-benchmark-image.yml

@@ -14,6 +14,7 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       packages: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/publish-smoke-test-early-jdk8-images.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     runs-on: ubuntu-latest
     steps:
@@ -47,6 +48,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish

.github/workflows/publish-smoke-test-fake-backend-images.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   publishLinux:
     permissions:
+      contents: read
       packages: write
     runs-on: ubuntu-latest
     steps:
@@ -47,6 +48,7 @@ jobs:
 
   publishWindows:
     permissions:
+      contents: read
       packages: write
     runs-on: windows-latest
     defaults:
@@ -82,6 +84,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publishLinux

.github/workflows/publish-smoke-test-grpc-images.yml

@@ -15,13 +15,15 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
       project: ":smoke-tests:images:grpc"
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish

.github/workflows/publish-smoke-test-play-images.yml

@@ -15,13 +15,15 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
       project: ":smoke-tests:images:play"
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish

.github/workflows/publish-smoke-test-quarkus-images.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
@@ -25,6 +26,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish

.github/workflows/publish-smoke-test-security-manager-images.yml

@@ -15,13 +15,15 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
       project: ":smoke-tests:images:security-manager"
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish

.github/workflows/publish-smoke-test-servlet-images.yml

@@ -24,6 +24,7 @@ jobs:
 
   publish:
     permissions:
+      contents: read
       packages: write
     needs: prepare
     runs-on: ${{ matrix.os }}
@@ -87,6 +88,7 @@ jobs:
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish

.github/workflows/publish-smoke-test-spring-boot-images.yml

@@ -15,13 +15,15 @@ permissions:
 jobs:
   publish:
     permissions:
+      contents: read
       packages: write
     uses: ./.github/workflows/reusable-publish-smoke-test-images.yml
     with:
       project: ":smoke-tests:images:spring-boot"
 
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     needs:
       - publish

.github/workflows/reusable-publish-smoke-test-images.yml

@@ -36,6 +36,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       packages: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

.github/workflows/reusable-workflow-notification.yml

@@ -15,6 +15,7 @@ permissions:
 jobs:
   workflow-notification:
     permissions:
+      contents: read
       issues: write
     runs-on: ubuntu-latest
     steps: