Specify default permissions for pr-verification.yml

[Tomomi-K1]

Fixes #8585

What changes did you make?

• added top level permissions block according to the issue Specify default permissions for pr-verification.yml #8585 : content: read

Why did you make the changes (we will use this info to test)?

• To align with GitHub security best practices, we want to specify the minimum required permissions for each workflow via a top-level permissions: block to ensure that workflows only have the access they need by default.

CodeQL Alerts

After the PR has been submitted and the resulting GitHub actions/checks have been completed, developers should check the PR for CodeQL alert annotations.

Check the PR's comments. If present on your PR, the CodeQL alert looks similar as shown

Please let us know that you have checked for CodeQL alerts. Please do not dismiss alerts.

• I have checked this PR for CodeQL alerts and none were found.
• I found CodeQL alert(s), and (select one):
  • I have resolved the CodeQL alert(s) as noted
  • I believe the CodeQL alert(s) is a false positive (Merge Team will evaluate)
  • I have followed the Instructions below, but I am still stuck (Merge Team will evaluate)

Instructions for resolving CodeQL alerts

If CodeQL alert/annotations appear, refer to How to Resolve CodeQL alerts.

In general, CodeQL alerts should be resolved prior to PR reviews and merging

Screenshots of Proposed Changes To The Website (if any, please do not include screenshots of code changes)

• No visual changes to the website
• I tested the workflow on my forked repo - successfully ran test log

I can confirmed now GITHUB_TOKEN has limited permissions in the test log.

before change I see these permissions under setup step of the log:

[github-actions]

Want to review this pull request? Take a look at this documentation for a step by step guide!

---

From your project repository, check out a new branch and test the changes.

git checkout -b Tomomi-K1-specify-default-permissions-for-pre-verification-8585 gh-pages
git pull https://github.com/Tomomi-K1/website.git specify-default-permissions-for-pre-verification-8585

[sushma110396]

Review ETA: 08/29 EOD
Availability: Weekdays after 6 PM PST

[sushma110396]

@Tomomi-K1, can you please include a link to your test log or attach it to this PR to verify your changes? Also, please make sure to check off the completed action items in issue #8585.

[jjam02]

Good

• The correct line of the file was changed
• The action seems to perform as expected

Changes needed

• the issue mentions attaching a log "If there are no errors, submit the PR like usual. Include a link to your test log." and I don't see one,
• check off all the action items.
  • not sure if you ran the action to confirm yourself and that's why there is no log?

[Tomomi-K1]

• he issue mentions attaching a log "If there are no errors, submit the PR like usual. Include a link to your test log." and I don't see one,

I'm so sorry, I made this pull request to see what happens to the workflow I changed so this PR was not ready. I should have put it back to "not ready" status 🙇

I attached the test log in the pull request description. I tested making a pull request on my forked repo, it ran successfully but closed the pull request automatically because I don't have access to organization's member from my fork. But this is expected behavior I believe. If I should test this differently, let me know! Thank you for volunteering to review this @jjam02 @sushma110396 🙏

[jjam02]

looks like the changes that were needed to be made got done. Looks good approved!

[Abigail-Diaz]

Review ETA: 08/26
Availability: Weekdays 9AM-1PM

[sushma110396]

@Tomomi-K1 No worries, Tomomi! Thanks for clarifying and for sharing the test log. I'll take a look at the changes and the testing details.

[mocodesss]

Review ETA: 08/27 EOD
Availability: Weekdays after 7:30 PM PST

[sushma110396]

Change looks good! I verified it locally, and all the required steps have been followed:

• There is a linked issue.
• The code change is correct, and the test log confirms the workflow runs as expected.
• The branch name is correct.

PR approved!

[Abigail-Diaz]

Hello @Tomomi-K1,

The changes passed local testing, with no visual changes. The merged branches also correctly triggered the pull_request_target event. The GITHUB_TOKEN permissions are correctly scoped to only Contents: read, Metadata: read, and Packages: read.

Great Job! :)