Backport workflow-hardening fix (excessive-permissions) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/verify.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 395cfc7

Affected release branches (5)

• release-0.24 (still present as of HEAD 4e7b7526)
• release-0.21 (still present as of HEAD 7fd020cb)
• release-0.22 (still present as of HEAD a19ec76a)
• release-0.19 (still present as of HEAD 5fe7bb3e)
• release-0.20 (still present as of HEAD 32e5e9e9)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-0.24 — excessive-permissions

File .github/workflows/verify.yml; suggested edits:

• • permissions.checks = 'write'

--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           ./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+  checks: write

release-0.21 — excessive-permissions

File .github/workflows/verify.yml; suggested edits:

• • permissions.checks = 'write'

--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           ./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+  checks: write

release-0.22 — excessive-permissions

File .github/workflows/verify.yml; suggested edits:

• • permissions.checks = 'write'

--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           ./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+  checks: write

release-0.19 — excessive-permissions

File .github/workflows/verify.yml; suggested edits:

• • permissions.checks = 'write'

--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           ./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+  checks: write

release-0.20 — excessive-permissions

File .github/workflows/verify.yml; suggested edits:

• • permissions.checks = 'write'

--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -16,3 +16,5 @@
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           ./hack/verify-pr-title.sh "${PR_TITLE}"
+permissions:
+  checks: write

---

Happy to open pull requests instead if that's preferred.

[troy0820]

release-19, release-20, release-21, release-22, are no longer maintained (n-2) but we may be able to do this for releaes-0.24.

[Om-Beast]

Hi @troy0820, I'd be happy to work on backporting the workflow hardening fix to the release-0.24 branch if it's still needed. If that works for you, I'll open a PR targeting release-0.24. Thanks!