[ci] Fix apache/pulsar-test-infra/paths-filter action permission in CodeQL workflow

[yaalsn]

Motivation

The codeql workflow needs read pull-requests permission when use action apache/pulsar-test-infra/paths-filter@master

[shoothzj]

Could you please share the fail link, in my memory, CodeQL workflow always run well.

[hangc0276]

Could you please share the fail link, in my memory, CodeQL workflow always run well.

@shoothzj We run the CI in our own repo and found the CodeQL doesn't have permission

[shoothzj]

IMO, it's a little hard to maintaince this change, the community doesn't face this problem, at least we should have some CodeQL documentaion.
I see the original permissions is copied from https://github.com/github/codeql-action/blob/59c62518002b2015b741cd192d3b36bc7787efc7/README.md.

Or we can test it in a fork repo? I can help with this :)

[yaalsn]

Hi @shoothzj , I think this workflow works well in public forked repo, but if it is a private repo, we need to declare the pull-requests permission because the following action needs to request github list PRs api using GITHUB_TOKEN. The workflow needs this permission and it wasn't added before, I just add it to fix the permission.

  - name: Detect changed files
    id: changes
    uses: apache/pulsar-test-infra/paths-filter@master
    with:
      filters: .github/changes-filter.yaml
      list-files: csv

[yaalsn]

I updated the title and commit msg, maybe it is more accurate.

[eolivelli]

Is this change exposing secrets to github users?

@yaalsn if you want to maintain a provate fork I think that you have already other changes that are no here in the public repo.
If this change add security risky for the community I suggest to push this change only to your repo

[shoothzj]

@yaalsn Thanks for your explanation, I change my mind to +0, I won't block this PR. But it seems werid you still needs Approval to triggered from CI. You already have pr merged into repo.

Thanks for your explanation, I change my mind to +0

[yaalsn]

Is this change exposing secrets to github users?
If this change add security risky for the community I suggest to push this change only to your repo

@eolivelli

No, it doesn't expose secret to anyone or add secrity risky, because the github action apache/pulsar-test-infra/paths-filter@master is reliable. Instead, it add the safety.

This is a github security setting. We should declare the workflow job permission, this makes the ones who forked repo know which permissions it uses instead of a black box. apache/bookkeeper just uses the default non-security strategy, this means the PRs github action can do anything using GITHUB_TOKEN after the PR is approved to run, but the reviewers don't know the action does clearly.

docs:

• https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs