[CI] workflow permissions

ghstack-source-id: f520a1b1e7697b1147cb29e66e2ecb1d07cb4cbc
Pull Request resolved: #2706

.github/workflows/benchmarks.yml

@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  id-token: write
   deployments: write
   contents: write
 

.github/workflows/docs.yml

@@ -18,6 +18,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   build-docs:
     strategy:

.github/workflows/lint.yml

@@ -15,6 +15,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   python-source-and-configs:
     uses: pytorch/test-infra/.github/workflows/linux_job_v2.yml@main

.github/workflows/nightly_build.yml

@@ -27,6 +27,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   build-wheel-linux:
     # Don't run on forked repos.

.github/workflows/test-linux-habitat.yml

@@ -15,6 +15,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   tests:
     strategy:

.github/workflows/test-linux-libs.yml

@@ -15,6 +15,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
 
   unittests-atari-dqn:

.github/workflows/test-linux-rlhf.yml

@@ -15,6 +15,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   unittests:
     strategy:

.github/workflows/test-linux-sota.yml

@@ -18,6 +18,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   tests:
     strategy:

.github/workflows/test-linux.yml

@@ -18,6 +18,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   tests-cpu:
     strategy:

.github/workflows/test-windows-optdepts.yml

@@ -15,6 +15,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   unittests-cpu:
     uses: pytorch/test-infra/.github/workflows/windows_job.yml@main

.github/workflows/wheels-legacy.yml

@@ -13,6 +13,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/main' && format('ci-master-{0}', github.sha) || format('ci-{0}', github.ref) }}
   cancel-in-progress: true
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
 
   build-wheel-windows: