Granular Workflow Permissions

[nubtron]

What does this PR do?

This PR implements the necessary preparations to set default workflow permissions to "Read-only" and to disable "Allow GitHub Actions to create and approve pull requests". We want to set those options to their most restrictive values for security reasons. See https://datadoghq.atlassian.net/browse/VULN-8234 for more information.

I did my best to isolate and test steps that might require permissions, but since actions that require permissions typically have side effects (for eg. creating a release), I didn't test everything. If you get permission issues after this PR is merged reach out to me!

The permissions affect GITHUB_TOKEN.

Here are some jobs that were confirmed not to require write permissions:

• upload-artifact. It uses a system separate from GITHUB_TOKEN.
• Creating a GitHub App Token.
• Deleting an artifact with geekyeggo/delete-artifact@v5
• Writing / or restoring a cache with actions/cache@v4.
• Writing a comment while using the DD_AGENT_INTEGRATIONS_BOT_PRIVATE_KEY.

Our actions that update dependencies, label PRs or create backports should not be affected as they use the Agent Integrations App key, not the GitHub token.

Temporary workflow I used to check permissions:
https://github.com/DataDog/integrations-core/actions/runs/11818825782/workflow
Here is a run:
https://github.com/DataDog/integrations-core/actions/runs/11798454943/job/32864652866

Motivation

This PR is the first step in complying with https://datadoghq.atlassian.net/browse/VULN-8234.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[datadog-agent-integrations-bot]

Permissions Test

[datadog-agent-integrations-bot]

Permissions Test

[datadog-agent-integrations-bot]

Permissions Test

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.75%. Comparing base (1583b10) to head (9ce0ec0).
Report is 6 commits behind head on master.

Additional details and impacted files

Flag	Coverage Δ
activemq	?
cassandra	?
hive	?
hivemq	?
hudi	?
ignite	?
jboss_wildfly	?
kafka	?
presto	?
solr	?
sqlserver	91.05% <100.00%> (+9.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.