Actions Permission and Other CodeQL Fixes

.github/workflows/blossom-ci.yml

@@ -13,13 +13,8 @@ on:
             required: false
 
 permissions:
-  actions: write
-  checks: write
-  contents: write
-  issues: write
-  pull-requests: write
-  repository-projects: write
-  statuses: write
+  contents: read
+  pull-request: read
 
 jobs:
   Authorization:

.github/workflows/build_docs.yml

@@ -12,6 +12,9 @@ on:
       - main
       - releasing/*
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: build-docs-${{ github.event.pull_request.number || github.ref }}

.github/workflows/chatops.yml

@@ -1,6 +1,9 @@
 # triggering the workflows by commenting `/black` and `/integration-test`
 name: chatops
 
+permissions:
+  contents: read
+
 # currently dispatches /black command to project-monai/monai-code-formatter
 on:
   issue_comment:

.github/workflows/cicd_tests.yml

@@ -21,6 +21,9 @@ on:
       - '**.rst'
       - 'docs/**'
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: cicd-tests-${{ github.event.pull_request.number || github.ref }}

.github/workflows/conda.yml

@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: conda-tests-${{ github.event.pull_request.number || github.ref }}

.github/workflows/cron-ngc-bundle.yml

@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: bundle-tests-${{ github.event.pull_request.number || github.ref }}

.github/workflows/cron.yml

@@ -7,6 +7,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   cron-gpu:
     if: github.repository == 'Project-MONAI/MONAI'

.github/workflows/docker.yml

@@ -13,6 +13,9 @@ on:
   # This is to trigger building/testing docker image from dev only.
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   versioning_dev:
     # compute versioning file from python setup.py

.github/workflows/integration.yml

@@ -5,6 +5,9 @@ on:
   repository_dispatch:
     type: [integration-test-command]
 
+permissions:
+  contents: read
+
 jobs:
   integration-auto3dseg:
     container:

.github/workflows/pythonapp-gpu.yml

@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: build-gpu-${{ github.event.pull_request.number || github.ref }}

.github/workflows/pythonapp-hyena-gpu.yml

@@ -22,6 +22,9 @@ name: hyena-gpu
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: hyena-gpu-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true

.github/workflows/release.yml

@@ -8,6 +8,9 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: read
+
 jobs:
   packaging:
     runs-on: ubuntu-latest

.github/workflows/setupapp.yml

@@ -13,6 +13,9 @@ on:
     # Allows you to run this workflow manually from the Actions tab
     workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # automatically cancel the previously triggered workflows when there's a newer version
   group: deploy-${{ github.event.pull_request.number || github.ref }}