👷 Improve workflows for private repos (#2394)

.github/workflows/add-to-project.yml

@@ -12,6 +12,7 @@ permissions: {}
 jobs:
   add-to-project:
     name: Add to project
+    if: github.repository_owner == 'fastapi'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

.github/workflows/deploy-production.yml

@@ -5,7 +5,8 @@ on:
     types:
       - published
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   deploy:

.github/workflows/deploy-staging.yml

@@ -5,7 +5,8 @@ on:
     branches:
       - master
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   deploy:

.github/workflows/playwright.yml

@@ -12,7 +12,8 @@ on:
         required: false
         default: 'false'
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   changes:
@@ -24,6 +25,7 @@ jobs:
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
+        fetch-depth: 2
         persist-credentials: false
     # For pull requests it's not necessary to checkout the code but for the main branch it is
     - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2

.github/workflows/pre-commit.yml

@@ -2,7 +2,8 @@ name: pre-commit
 
 on:
   pull_request:
-permissions: {}
+permissions:
+  contents: read
 
 env:
   # Forks and Dependabot don't have access to secrets

.github/workflows/smokeshow.yml

@@ -13,6 +13,7 @@ jobs:
     timeout-minutes: 5
     permissions:
       actions: read
+      contents: read
       statuses: write
 
     steps:

.github/workflows/test-backend.yml

@@ -5,7 +5,8 @@ on:
     branches:
       - master
   pull_request:
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   test-backend:

.github/workflows/test-docker-compose.yml

@@ -5,7 +5,8 @@ on:
     branches:
       - master
   pull_request:
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
 

.github/workflows/zizmor.yml

@@ -15,6 +15,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
+      actions: read
+      contents: read
       security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
     steps:
       - name: Checkout repository
@@ -23,3 +25,6 @@ jobs:
           persist-credentials: false
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          advanced-security: ${{ github.repository_owner == 'fastapi' }}
+          annotations: ${{ github.repository_owner != 'fastapi' }}