Merge branch 'main' into agents/finance_compose

Author: ashahba

.github/workflows/_build_comps_base_image.yml

@@ -2,7 +2,12 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Build Comps Base Image
-permissions: read-all
+
+permissions:
+  attestations: read
+  models: read
+  security-events: read
+
 on:
   workflow_call:
     inputs:

.github/workflows/_build_image.yml

@@ -2,7 +2,22 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Build Images
-permissions: read-all
+permissions:
+  actions: read
+  contents: read
+  checks: read
+  deployments: read
+  discussions: read
+  issues: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  statuses: read
+  security-events: read
+  id-token: write
+  attestations: read
+  models: read
 on:
   workflow_call:
     inputs:

.github/workflows/_example-workflow.yml

@@ -2,7 +2,22 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Example jobs
-permissions: read-all
+permissions:
+  actions: read
+  contents: read
+  checks: read
+  deployments: read
+  discussions: read
+  issues: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  statuses: read
+  security-events: read
+  id-token: write
+  attestations: read
+  models: read
 on:
   workflow_call:
     inputs:

.github/workflows/_get-image-list.yml

@@ -2,7 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Get Image List
-permissions: read-all
+permissions:
+  contents: read
 on:
   workflow_call:
     inputs:

.github/workflows/_gmc-e2e.yml

@@ -3,7 +3,8 @@
 
 # This workflow will only test GMC pipeline and will not install GMC any more
 name: Single GMC E2e Test For CD Workflow Call
-
+permissions:
+  contents: read
 on:
   workflow_call:
     inputs:

.github/workflows/_gmc-workflow.yml

@@ -2,7 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Build and deploy GMC system on call and manual
-
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:

.github/workflows/dockerhub-description.yml

@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Update Docker Hub Description
+permissions:
+  contents: read
 on:
   schedule:
     - cron: "0 0 * * 0"

.github/workflows/manual-docker-clean.yml

@@ -2,6 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Clean up container on manual event
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:

.github/workflows/manual-example-workflow.yml

@@ -2,6 +2,24 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Examples CD workflow on manual event
+
+permissions:
+  actions: read
+  contents: read
+  checks: read
+  deployments: read
+  discussions: read
+  issues: read
+  packages: read
+  pages: read
+  pull-requests: read
+  repository-projects: read
+  statuses: read
+  security-events: read
+  id-token: write
+  attestations: read
+  models: read
+
 on:
   workflow_dispatch:
     inputs:
@@ -51,7 +69,6 @@ on:
         required: false
         type: boolean
 
-permissions: read-all
 jobs:
   get-test-matrix:
     runs-on: ubuntu-latest

.github/workflows/manual-freeze-tag.yml

@@ -2,7 +2,8 @@
 # SPDX-License-Identifier: Apache-2.0
 
 name: Freeze OPEA images release tag
-
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs: