Thanks @ezio-melotti for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

Sorry, @ezio-melotti, I could not cleanly backport this to 3.14 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1f36a510a2a16e8ff15572f44090c7db43bb7935 3.14

Sorry, @ezio-melotti, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1f36a510a2a16e8ff15572f44090c7db43bb7935 3.13

GH-148115 is a backport of this pull request to the 3.14 branch.

GH-148116 is a backport of this pull request to the 3.13 branch.

Thanks @ezio-melotti for the PR 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

Sorry, @ezio-melotti, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1f36a510a2a16e8ff15572f44090c7db43bb7935 3.10

Sorry, @ezio-melotti, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1f36a510a2a16e8ff15572f44090c7db43bb7935 3.11

Sorry, @ezio-melotti, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1f36a510a2a16e8ff15572f44090c7db43bb7935 3.12

GH-148122 is a backport of this pull request to the 3.12 branch.

GH-148123 is a backport of this pull request to the 3.11 branch.

Just a head-up that this breaks CI on private forks, I think (since now they can't read the repo anymore).

Yep, the content privilege is implicit in public repos. It may make sense to have it everywhere with actions/checkout. But perhaps on the job level instead of workflow..

The motivation for this PR was to satisfy the CodeQL scanner, and make sure we have some at least ~minimal default at the top level.

I think we're fine with using this everywhere:

permissions:
  contents: read

It does this:

contents: Work with the contents of the repository. For example, contents: read permits an action to list the commits [...]

https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#permissions

Yep, that works! Do you want to fix it, or should I?

I also wonder if that's a worthwhile CodeQL lint, or we should just disable it. contents: read is already the default (and a reasonable one that's unlikely to change). "Fixing" the lint by repeating the default just seems to add more noise to some already noisy files.

Yep, that works! Do you want to fix it, or should I?

I can probably do it tomorrow, but feel free to do it yourself before that :)

contents: read is already the default (and a reasonable one that's unlikely to change).

If only it was this simple :)

It's something like this: for older orgs/repos, the default is permissive, with read/write for all scopes. Newer ones have a restricted default, read-only for contents and packages. There's also repo and org settings to adjust this.

And then there's forks...

So explicit is good here.

Follow up: #148346