[CI] Scope workflow permissions and secret inheritance

[thisisnic]

Describe the enhancement

Some workflows use overly broad permissions or pass all secrets to called workflows via secrets: inherit. These should be tightened to follow the principle of least privilege.

Permissions

• .github/workflows/package_linux.yml has contents: write at the workflow level — this should be scoped to the specific job that needs it.

Secret inheritance

The following workflows pass all secrets to reusable workflows via secrets: inherit instead of explicitly listing required secrets:

• .github/workflows/cpp_extra.yml (2 instances)
• .github/workflows/cuda_extra.yml (2 instances)
• .github/workflows/package_linux.yml (2 instances)
• .github/workflows/python.yml
• .github/workflows/r.yml

Component(s)

Continuous Integration

[thisisnic]

I don't think we need this, as we're pinning to SHAs in #49735 so this is already mitigated - what do you think @kou?

[kou]

* `.github/workflows/package_linux.yml` has `contents: write` at the workflow level — this should be scoped to the specific job that needs it.

We can move

arrow/.github/workflows/package_linux.yml

Lines 67 to 68 in 4eca507

	# Upload to GitHub Release
	contents: write

to

arrow/.github/workflows/package_linux.yml

Line 79 in 4eca507

package:

for this.

The following workflows pass all secrets to reusable workflows via secrets: inherit instead of explicitly listing required secrets:

* `.github/workflows/cpp_extra.yml` (2 instances)

* `.github/workflows/cuda_extra.yml` (2 instances)

* `.github/workflows/package_linux.yml` (2 instances)

* `.github/workflows/python.yml`

* `.github/workflows/r.yml`

It seems that python.yml and r.yml doesn't have secrets: inherit.

Other workflows use https://github.com/apache/arrow/blob/main/.github/workflows/check_labels.yml and https://github.com/apache/arrow/blob/main/.github/workflows/report_ci.yml .

check_labels needs only github.token.

report_ci needs only github.token, secrets.ARROW_SMTP_PASSWORD and ${{ secrets.ARROW_ZULIP_WEBHOOK }}.

So we can list them explicitly instead of using secrets: inherit.

In general, minimum permissions/secrets are better but the ASF GitHub Actions policy doesn't require them. So these changes are not required. They are just better.

If you can create a PR with generative AI, let's do them.

[thisisnic]

Thanks! Should be easily automated with genAI, I'll get a PR up

[thisisnic]

Issue resolved by pull request 49773
#49773