test permissions (#1264)

* test permissions

* test least permissions

* remove contents permissions

* testing permisions

* Update deploy-website.yml permission block

---------

Co-authored-by: Davor Runje <[email protected]>
Co-authored-by: Eric Zhu <[email protected]>
Co-authored-by: Chi Wang <[email protected]>

Author: 4 people

.github/workflows/build.yml

@@ -19,7 +19,11 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
+permissions: {}
+    # actions: read
+  # checks: read
+  # contents: read
+  # deployments: read
 jobs:
   build:
     runs-on: ${{ matrix.os }}

.github/workflows/contrib-openai.yml

@@ -11,7 +11,11 @@ on:
       - 'test/agentchat/contrib/**'
       - '.github/workflows/contrib-openai.yml'
       - 'setup.py'
-
+permissions: {}
+    # actions: read
+  # checks: read
+  # contents: read
+  # deployments: read
 jobs:
   RetrieveChatTest:
     strategy:

.github/workflows/contrib-tests.yml

@@ -15,7 +15,11 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
+permissions: {}
+    # actions: read
+  # checks: read
+  # contents: read
+  # deployments: read
 jobs:
   RetrieveChatTest:
     runs-on: ${{ matrix.os }}

.github/workflows/deploy-website.yml

@@ -16,7 +16,12 @@ on:
   workflow_dispatch:
   merge_group:
     types: [checks_requested]
-
+permissions:
+  pages: write
+    # actions: read
+  # checks: read
+  # contents: read
+  # deployments: read
 jobs:
   checks:
     if: github.event_name != 'push'

.github/workflows/dotnet-run-openai-test-and-notebooks.yml

@@ -7,7 +7,11 @@ on:
       - 'dotnet/**'
 env:
   BUILD_CONFIGURATION: Release    # set this to the appropriate build configuration
-
+permissions: {}
+    # actions: read
+  # checks: read
+  # contents: read
+  # deployments: read
 jobs:
   build:
     environment: dotnet

.github/workflows/openai.yml

@@ -12,6 +12,11 @@ on:
       - "notebook/agentchat_auto_feedback_from_code_execution.ipynb"
       - "notebook/agentchat_function_call.ipynb"
       - ".github/workflows/openai.yml"
+permissions: {}
+    # actions: read
+  # checks: read
+  # contents: read
+  # deployments: read
 
 jobs:
   test:

.github/workflows/pre-commit.yml

@@ -9,7 +9,11 @@ on:  # Trigger the workflow on pull request or merge
 defaults:
   run:
     shell: bash
-
+permissions: {}
+    # actions: read
+  # checks: read
+  # contents: read
+  # deployments: read
 jobs:
 
   pre-commit-check:

.github/workflows/python-package.yml

@@ -7,7 +7,11 @@ name: python-package
 on:
   release:
     types: [published]
-
+permissions: {}
+  # actions: read
+  # checks: read
+  # contents: read
+  # deployments: read
 jobs:
   deploy:
     strategy: