Infra: tighten github_token security (#4043)

Co-authored-by: Narek Matevosyan <nmatevosyan@provectus.com>

.github/workflows/backend.yml

@@ -3,11 +3,14 @@ on:
   push:
     branches:
       - master
-  pull_request:
+  pull_request_target:
     types: ["opened", "edited", "reopened", "synchronize"]
     paths:
       - "kafka-ui-api/**"
       - "pom.xml"
+permissions:
+  checks: write
+  pull-requests: write
 jobs:
   build-and-test:
     runs-on: ubuntu-latest

.github/workflows/e2e-checks.yaml

@@ -1,6 +1,6 @@
 name: "E2E: PR healthcheck"
 on:
-  pull_request:
+  pull_request_target:
     types: [ "opened", "edited", "reopened", "synchronize" ]
     paths:
       - "kafka-ui-api/**"
@@ -8,6 +8,8 @@ on:
       - "kafka-ui-react-app/**"
       - "kafka-ui-e2e-checks/**"
       - "pom.xml"
+permissions:
+  statuses: write
 jobs:
   build-and-test:
     runs-on: ubuntu-latest
@@ -18,8 +20,8 @@ jobs:
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v2
         with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-access-key-id: ${{ secrets.S3_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.S3_AWS_SECRET_ACCESS_KEY }}
           aws-region: eu-central-1
       - name: Set up environment
         id: set_env_values

.github/workflows/frontend.yaml

@@ -3,11 +3,14 @@ on:
   push:
     branches:
       - master
-  pull_request:
+  pull_request_target:
     types: ["opened", "edited", "reopened", "synchronize"]
     paths:
       - "kafka-ui-contract/**"
       - "kafka-ui-react-app/**"
+permissions:
+  checks: write
+  pull-requests: write
 jobs:
   build-and-test:
     env:

.github/workflows/pr-checks.yaml

@@ -1,8 +1,9 @@
 name: "PR: Checklist linter"
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, edited, synchronize, reopened]
-
+permissions:
+  checks: write
 jobs:
   task-check:
     runs-on: ubuntu-latest

.github/workflows/welcome-first-time-contributors.yml

@@ -1,13 +1,15 @@
 name: Welcome first time contributors
 
 on:
-  pull_request:
+  pull_request_target:
     types:
       - opened
   issues:
     types:
       - opened
-
+permissions:
+  issues: write
+  pull-requests: write
 jobs:
   welcome:
     runs-on: ubuntu-latest