feat: harden permissions for all github workflows

[joycebrum]

Summary

Signed-off-by: Joyce Brum <[e-mail]>

[joycebrum]

Hi, let me know if any permission is missing, I tried to look into the actions to figured out but may have missed something.

[tstellar]

LGTM. I tested this here with our stable branch CI jobs: https://github.com/llvm/llvm-project-release-prs/pull/309

[tstellar]

@joycebrum Do you need me to commit this for you?

[joycebrum]

In D144119#4159833, @tstellar wrote:

@joycebrum Do you need me to commit this for you?

Please! I think I don't have access to do that. Thanks!

.github/workflows/clang-tests.yml

 name: Clang Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
     ignore-forks: true
     branches:
       - 'release/**'
     paths:
       - 'clang/**'

.github/workflows/closed-issues.yml

 name: Labeling closed issues
 on:
   issues:
     types: ['closed']
 
+permissions:
+  contents: read
+
 jobs:
   automate-issues-labels:
+    permissions:
+      issues: write  # for andymckay/labeler to label issues
+      pull-requests: write  # for andymckay/labeler to label PRs
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:
       - uses: andymckay/labeler@1.0.4
         with:
           remove-labels: 'awaiting-review'

.github/workflows/issue-release-workflow.yml

 # This contains the workflow definitions that allow users to test backports
 # to the release branch using comments on issues.
 #
 # /cherry-pick <commit> <...>
 #
 # This comment will attempt to cherry-pick the given commits to the latest
 # release branch (release/Y.x) and if successful, push the result to a branch
 # on github.
 #
 # /branch <owner>/<repo>/<branch>
 #
 # This comment will create a pull request from <branch> to the latest release
 # branch.
 
 name: Issue Release Workflow
 
+permissions:
+  contents: read
+
 on:
   issue_comment:
     types:
       - created
       - edited
   issues:
     types:
       - opened

.github/workflows/issue-subscriber.yml

 name: Issue Subscriber
 
 on:
   issues:
     types:
       - labeled
 
+permissions:
+  contents: read
+
 jobs:
   auto-subscribe:
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:
       - name: Setup Automation Script
         run: |
           curl -O -L https://raw.githubusercontent.com/$GITHUB_REPOSITORY/$GITHUB_SHA/llvm/utils/git/github-automation.py

.github/workflows/libclang-abi-tests.yml

 name: libclang ABI Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
     ignore-forks: true
     branches:
       - 'release/**'
     paths:
       - 'clang/**'

.github/workflows/libclc-tests.yml

 name: libclc Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
     ignore-forks: true
     branches:
       - 'release/**'
     paths:
       - 'libclc/**'

.github/workflows/lld-tests.yml

 name: LLD Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
     ignore-forks: true
     branches:
       - 'release/**'
     paths:
       - 'lld/**'

.github/workflows/lldb-tests.yml

 name: lldb Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
     ignore-forks: true
     branches:
       - 'release/**'
     paths:
       - 'lldb/**'

.github/workflows/llvm-bugs.yml

 name: LLVM Bugs notifier
 
+permissions:
+  contents: read
+  issues: read
+
 on:
   issues:
     types:
       - opened
 
 jobs:
   auto-subscribe:
     runs-on: ubuntu-latest

.github/workflows/llvm-project-tests.yml

 name: LLVM Project Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:
       build_target:
         required: false
       projects:
         required: false
   workflow_call:

.github/workflows/llvm-tests.yml

 name: LLVM Tests
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
     ignore-forks: true
     branches:
       - 'release/**'
     paths:
       - 'llvm/**'

.github/workflows/new-issues.yml

 name: Labeling new issues
 on:
   issues:
     types: ['opened']
 
+permissions:
+  contents: read
+
 jobs:
   automate-issues-labels:
+    permissions:
+      issues: write  # for andymckay/labeler to label issues
+      pull-requests: write  # for andymckay/labeler to label PRs
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:
       - uses: andymckay/labeler@1.0.4
         with:
           add-labels: 'new issue'
           ignore-if-labeled: true

.github/workflows/release-tasks.yml

 name: Release Task
 
+permissions:
+  contents: read
+
 on:
   push:
     tags:
       # The regex support here is limited, so just match everything that starts with llvmorg- and filter later.
       - 'llvmorg-*'
 
 jobs:
   release-tasks:
+    permissions:
+      contents: write # To upload assets to release.
     runs-on: ubuntu-latest
     if: github.repository == 'llvm/llvm-project'
     steps:
       - name: Validate Tag
         id: validate-tag
         run: |
           test "${{ github.actor }}" = "tstellar" || test "${{ github.actor }}" = "tru"
           echo "${{ github.ref_name }}" | grep -e '^llvmorg-[0-9]\+\.[0-9]\+\.[0-9]\+\(-rc[0-9]\+\)\?$'

.github/workflows/version-check.yml

 name: LLVM Project Version Check
 
 on:
   push:
     branches:
       - 'release/**'
   pull_request:
     branches:
       - 'release/**'
 
+permissions:
+  contents: read
+
 jobs:
   version_check:
     if: github.repository_owner == 'llvm'
     runs-on: ubuntu-latest
     steps:
       - name: Fetch LLVM sources
         uses: actions/checkout@v3
         with: