e2e: adjust some pipeline settings (#36178)

.github/workflows/e2e-tests-ci.yml

@@ -23,6 +23,9 @@ on:
         type: string
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   resolve-pr:
     runs-on: ubuntu-24.04
@@ -206,6 +209,7 @@ jobs:
       - check-changes
     if: needs.resolve-pr.outputs.PR_NUMBER != ''
     permissions:
+      contents: read
       statuses: write
     uses: ./.github/workflows/e2e-tests-cypress.yml
     with:
@@ -231,6 +235,7 @@ jobs:
       - check-changes
     if: needs.resolve-pr.outputs.PR_NUMBER != ''
     permissions:
+      contents: read
       statuses: write
     uses: ./.github/workflows/e2e-tests-playwright.yml
     with:
@@ -254,6 +259,7 @@ jobs:
       - check-changes
     if: needs.resolve-pr.outputs.PR_NUMBER != '' && needs.check-changes.outputs.should_run_fips == 'true'
     permissions:
+      contents: read
       statuses: write
     uses: ./.github/workflows/e2e-tests-cypress.yml
     with:
@@ -279,6 +285,7 @@ jobs:
       - check-changes
     if: needs.resolve-pr.outputs.PR_NUMBER != '' && needs.check-changes.outputs.should_run_fips == 'true'
     permissions:
+      contents: read
       statuses: write
     uses: ./.github/workflows/e2e-tests-playwright.yml
     with:

.github/workflows/e2e-tests-cypress.yml

@@ -62,6 +62,9 @@ on:
       CWS_EXTRA_HTTP_HEADERS:
         required: false
 
+permissions:
+  contents: read
+
 jobs:
   generate-build-variables:
     runs-on: ubuntu-24.04

.github/workflows/e2e-tests-playwright-template.yml

@@ -99,6 +99,11 @@ on:
       AWS_SECRET_ACCESS_KEY:
         required: true
 
+# Callers must grant at least these scopes on the job that uses this workflow
+permissions:
+  contents: read
+  statuses: write
+
 env:
   SERVER_IMAGE: "${{ inputs.server_image_repo }}/${{ inputs.server_edition == 'fips' && 'mattermost-enterprise-fips-edition' || inputs.server_edition == 'team' && 'mattermost-team-edition' || 'mattermost-enterprise-edition' }}:${{ inputs.server_image_tag }}"
 

.github/workflows/e2e-tests-playwright.yml

@@ -56,6 +56,9 @@ on:
       AWS_SECRET_ACCESS_KEY:
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   generate-build-variables:
     runs-on: ubuntu-24.04
@@ -140,6 +143,7 @@ jobs:
     if: inputs.should_run == 'false'
     runs-on: ubuntu-24.04
     permissions:
+      contents: read
       statuses: write
     steps:
       - name: ci/post-skip-status
@@ -159,6 +163,9 @@ jobs:
     needs:
       - generate-build-variables
     if: inputs.should_run != 'false'
+    permissions:
+      contents: read
+      statuses: write
     uses: ./.github/workflows/e2e-tests-playwright-template.yml
     with:
       test_type: full