[release-24.0] CI: tighten workflow token permissions and checkout credentials (#20785)

[vitess-bot]

Description

This is a backport of #20785

[vitess-bot]

Hello @arthurschreiber, there are conflicts in this backport.

Please address them in order to merge this Pull Request. You can execute the snippet below to reset your branch and resolve the conflict manually.

Make sure you replace origin by the name of the vitessio/vitess remote

git fetch --all
gh pr checkout 20796
git reset --hard origin/release-24.0
git cherry-pick -m 1 b9592239c4bc9eab0fe12a8a53b9c66fa11ce6fd

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates GitHub Actions workflows to tighten default token permissions and avoid persisting checkout credentials.

Changes:

• Replace broad permissions: read-all with least-privilege contents: read in several workflows.
• Disable persisted Git credentials during checkout in update-related workflows.
• Add scoped job permissions for Slack notification job.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/update_golang_version.yml	Disables persisted checkout credentials for the matrix branch checkout.
.github/workflows/pr_opened_tasks.yml	Narrows workflow token permissions from read-all to contents: read.
.github/workflows/error_code_docs_generate.yml	Attempts to update checkout action and disable persisted credentials (currently contains conflict markers).
.github/workflows/docker_lite_build_check.yml	Narrows workflow token permissions from read-all to contents: read.
.github/workflows/docker_build_images.yml	Narrows workflow token permissions and adds job-level actions: read for Slack notification.
.github/workflows/create_release.yml	Updates the comment describing the release asset action version pin.
.github/workflows/cluster_endtoend.yml	Narrows workflow token permissions from read-all to contents: read.
.github/workflows/backport.yml	Requests additional permissions for the GitHub App token used in backport automation.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

[arthurschreiber]

Resolved the conflicts.

The only real conflict was in error_code_docs_generate.yml, and it was about the checkout pin: this branch is on actions/checkout v6.0.2 where main is on v7.0.0. I kept this branch's pin and applied only what #20785 adds there, persist-credentials: 'false' — a backport shouldn't bump an action version.

One deliberate deviation from a straight backport: I folded in #20792, which adds permission-workflows: write to the app token in backport.yml. #20785 is what removed that permission (by scoping a token that previously inherited everything), and it broke backporting of any CI change on main until #20792 landed. Backporting #20785 alone would have carried the same regression here, so the two belong together.

All 8 files from #20785 are present, no conflict markers remain, and no Go files change.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.