Restrict workflow token permissions to minimal required access

[Copilot]

• Analyze each workflow file to understand what permissions are needed
• Set minimal permissions for everything.yml workflow
  • Add top-level read-only permissions
  • Add job-level write permissions where needed (caching, artifacts, etc.)
  • Remove redundant job-level read permissions (inherited from global)
• Fix external.yml workflow to use minimal permissions instead of write-all
• Add permissions to pypackaging.yml workflow jobs that are missing them
• Add permissions to stale.yml workflow for issue/PR management
• Validate all changes follow the principle of least privilege

Summary of Changes:

All workflows now have explicit, minimal permissions set:

everything.yml: Added contents: read at top-level. Jobs that only need read access inherit from global setting. Jobs that need write permissions (cache save, upload artifacts) have explicit job-level permissions with both contents: read and the required write permission.

external.yml: Replaced overly permissive write-all with contents: read and statuses: write (minimal permissions needed for CDash status updates).

pypackaging.yml: Added explicit permissions to all jobs - contents: read and actions: write for jobs that upload artifacts, actions: read for jobs that download artifacts.

stale.yml: Added contents: read, issues: write, and pull-requests: write permissions for stale issue/PR management.

All changes follow the principle of least privilege, granting only the permissions each job specifically needs.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Restrict workflow token permissions</issue_title>
<issue_description>GitHub Actions workflows are using tokens with excessive permissions. Should explicitly set minimal permissions using the permissions: key in each workflow.

Most workflows should be read-only unless they specifically need write access.

Reference: https://github.com/ossf/scorecard/blob/c22063e786c11f9dd714d777a687ff7c4599b600/docs/checks.md#token-permissions</issue_description>

Comments on the Issue (you are @copilot in this section)

@vicentebolea Scorecard detailed results for Token-Permissions (0/10):

Debug: no jobLevel permission defined: .github/workflows/everything.yml:49
Debug: no jobLevel permission defined: .github/workflows/everything.yml:74
Debug: no jobLevel permission defined: .github/workflows/everything.yml:209
Debug: no jobLevel permission defined: .github/workflows/everything.yml:273
Debug: no jobLevel permission defined: .github/workflows/everything.yml:412
Debug: no jobLevel permission defined: .github/workflows/everything.yml:477
Debug: no jobLevel permission defined: .github/workflows/everything.yml:111
Debug: no jobLevel permission defined: .github/workflows/everything.yml:349
Info: jobLevel 'actions' permission set to 'read': .github/workflows/everything.yml:546
Info: jobLevel 'contents' permission set to 'read': .github/workflows/everything.yml:547
Debug: no jobLevel permission defined: .github/workflows/everything.yml:621
Debug: no jobLevel permission defined: .github/workflows/external.yml:9
Debug: no jobLevel permission defined: .github/workflows/pypackaging.yml:32
Debug: no jobLevel permission defined: .github/workflows/pypackaging.yml:51
Debug: no jobLevel permission defined: .github/workflows/stale.yml:8
Warn: no topLevel permission defined: .github/workflows/everything.yml:1
Warn: topLevel permissions set to 'write-all': .github/workflows/external.yml:6

Multiple jobs missing explicit permission definitions. The external.yml workflow has write-all permissions which is overly permissive. Most workflows should explicitly set read-only permissions and only grant write where necessary.</comment_new>

Fixes #4673

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[vicentebolea]

@copilot in everything.yaml remove explicit mentions of read perms since they are already globaly set as read.

[Copilot]

@copilot in everything.yaml remove explicit mentions of read perms since they are already globaly set as read.

Removed redundant contents: read from job-level permissions blocks. Jobs that only need read access now inherit from the global permissions setting. Jobs that need write permissions still explicitly declare both contents: read and their write permissions since job-level permissions override global settings. (fbdbed9)