[release/v7.4.15] [StepSecurity] ci: Harden GitHub Actions tokens (#27231)

.github/workflows/copilot-setup-steps.yml

@@ -0,0 +1,64 @@
+name: "Copilot Setup Steps"
+
+# Allow testing of the setup steps from your repository's "Actions" tab.
+on:
+  workflow_dispatch:
+
+  pull_request:
+    branches:
+      - master
+    paths:
+      - ".github/workflows/copilot-setup-steps.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  # The job MUST be called `copilot-setup-steps` or it will not be picked up by Copilot.
+  # See https://docs.github.com/en/copilot/customizing-copilot/customizing-the-development-environment-for-copilot-coding-agent
+  copilot-setup-steps:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    # You can define any steps you want, and they will run before the agent starts.
+    # If you do not check out your code, Copilot will do this for you.
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1000
+
+      - name: Bootstrap
+        if: success()
+        run: |-
+          $title = 'Import Build.psm1'
+          Write-Host "::group::$title"
+          Import-Module ./build.psm1 -Verbose -ErrorAction Stop
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Switch to public feed'
+          Write-LogGroupStart -Title $title
+          Switch-PSNugetConfig -Source Public
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Bootstrap'
+          Write-LogGroupStart -Title $title
+          Start-PSBootstrap -Scenario DotNet
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Install .NET Tools'
+          Write-LogGroupStart -Title $title
+          Start-PSBootstrap -Scenario Tools
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Sync Tags'
+          Write-LogGroupStart -Title $title
+          Sync-PSTags -AddRemoteIfMissing
+          Write-LogGroupEnd -Title $title
+
+          $title = 'Setup .NET environment variables'
+          Write-LogGroupStart -Title $title
+          Find-DotNet -SetDotnetRoot
+          Write-LogGroupEnd -Title $title
+        shell: pwsh

.github/workflows/windows-packaging-reusable.yml

@@ -13,6 +13,9 @@ env:
   SYSTEM_ARTIFACTSDIRECTORY: ${{ github.workspace }}/artifacts
   BUILD_ARTIFACTSTAGINGDIRECTORY: ${{ github.workspace }}/artifacts
 
+permissions:
+  contents: read
+
 jobs:
   package:
     name: ${{ matrix.architecture }} - ${{ matrix.channel }}

.github/workflows/xunit-tests.yml

@@ -14,6 +14,9 @@ on:
         required: false
         default: testResults-xunit
 
+permissions:
+  contents: read
+
 jobs:
   xunit:
     name: Run xUnit Tests