Backport workflow-hardening fix (excessive-permissions) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/kind-e2e-tests.yaml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 881d94d

Affected release branches (5)

• release-v0.27.3 (still present as of HEAD a243e2ab)
• release-v0.27.x (still present as of HEAD 29e1a4ae)
• release-v0.33.2 (still present as of HEAD 87a0a946)
• release-v0.33.x (still present as of HEAD 84011814)
• release-v0.33.1 (still present as of HEAD e319414e)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-v0.27.3 — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

• • permissions.contents = 'read'
• • permissions.issues = 'write'
• • permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -119,3 +119,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

release-v0.27.x — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

• • permissions.contents = 'read'
• • permissions.issues = 'write'
• • permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -119,3 +119,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

release-v0.33.2 — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

• • permissions.contents = 'read'
• • permissions.issues = 'write'
• • permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -133,3 +133,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

release-v0.33.x — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

• • permissions.contents = 'read'
• • permissions.issues = 'write'
• • permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -133,3 +133,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

release-v0.33.1 — excessive-permissions

File .github/workflows/kind-e2e-tests.yaml; suggested edits:

• • permissions.contents = 'read'
• • permissions.issues = 'write'
• • permissions.pull-requests = 'write'

--- a/.github/workflows/kind-e2e-tests.yaml
+++ b/.github/workflows/kind-e2e-tests.yaml
@@ -133,3 +133,7 @@
           notify_when: "failure"
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write

---

Happy to open pull requests instead if that's preferred.