tree df3fb0d6d2c09d8fc680a4fd29fe4279f855ab14
parent ab0da80c4984ba7505b7ed98825969a75b72c007
author bazel.build machine account <15028808+bazel-io@users.noreply.github.com> 1699462830 -0500
committer GitHub <noreply@github.com> 1699462830 +0000
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsBcBAABCAAQBQJlS76uCRBK7hj4Ov3rIwAAyvUIAGWQwkXlbftTJnhuY2SbEwUS
 UKO4VKHWDZwuKTvnC52uGoNBT2u0xBjZQNTgWb05TyltxQD3eAvYenOkThY2MMmy
 TwtswdyPuHWj9rw4eHpGx0j3imxNQcqi3UQVAIVAGG3sXU3Af0awGDvxEcxtiYQS
 nTIUHDOiNyI1Munhx3sMgUWkMc2bbjJ/jWAPdz0crWRprWcdn2MQ6qVggYBX6Hbp
 vGViYrht1+h0oOwIhoU+d7V8WOFZgB/kAHOx0O8uOXxum8puh7281el+xPnYBzmd
 ZyzzB9cE0tYc6TvGdSDPm6/bdyIRC7yv+L2B+EDbp0J5BJv/atV5Gc9YCSxYP/8=
 =B2u/
 -----END PGP SIGNATURE-----
 

[7.0.0] Add top-level permissions to cherry-picker and remove-labels.yml (#20113)

Fixes #20086.

As described in the issue, this PR adds read-only permissions to bazel's
workflows that don't yet have them. This reduces the risk of
supply-chain attacks via the project's CI/CD infrastructure.

My understanding is that `cherry-picker.yml` does not require any
additional permissions since everything done by
`bazelbuild/continuous-integration/actions/cherry_picker` uses the
declared `GH_TOKEN` instead of the workflow's default `GITHUB_TOKEN`. If
I'm mistaken, let me know and I'll happy fix the PR.

Closes #20087.

Commit
https://github.com/bazelbuild/bazel/commit/ba61ff7d2eb6ed697e12abe3688992e85c434b30

PiperOrigin-RevId: 580542813
Change-Id: Ib45164ea8d9c0aa583e91d316ad2b552f3c9b5b7

Co-authored-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>