Updated workflows with permission restrictions (#1267)

* Updated workflows

* Remove docs verifier for now

.github/workflows/bcnotify.yaml

@@ -1,19 +0,0 @@
-name: "bc-notification"
-on:
-  issues:
-    types: [edited, labeled]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 #@v2
-    - uses: timheuer/issue-notifier@84b8e0081c0abce88ac2673f1f3ad8529a040586 #@v1.0.2
-      env:
-        SENDGRID_API_KEY: ${{ secrets.SENDGRID_API }}
-      with:
-        fromMailAddress: '${{ secrets.BC_NOTIFY }}'
-        toMailAddress: '${{ secrets.BC_NOTIFY }}'
-        subject: 'BC:'
-        subjectPrefix: 'BC:'
-        labelsToMonitor: "breaking-change"

.github/workflows/build-validation.yml

@@ -2,10 +2,10 @@
 name: 'Snippets 5000'
 
 # Controls when the action will run. Triggers the workflow on push or pull request
+# events on the main branch only.
 on:
   pull_request:
-    paths:
+    branches: [ main ]
-    branches: '*'
     types: [opened, synchronize, reopened]
 
 env:
@@ -15,10 +15,12 @@ env:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
 jobs:
-  # This workflow contains a single job called "build snippets"
+  # This workflow contains a single job called "snippets-build"
-  build-snippets:
+  snippets-build:
     # The type of runner that the job will run on
     runs-on: windows-latest
+    permissions:
+        statuses: write
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:

.github/workflows/check-for-build-warnings.yml

@@ -1,4 +1,4 @@
-name: 'Status checker'
+name: 'OPS status checker'
 
 on: 
   pull_request_target:
@@ -8,6 +8,8 @@ jobs:
   status_checker_job:
     name: Look for build warnings
     runs-on: ubuntu-latest
+    permissions:
+        statuses: write
     steps:
     - uses: dotnet/docs-actions/actions/status-checker@main
       with:

.github/workflows/markdownlint.yml

@@ -2,6 +2,8 @@ name: Markdownlint
 
 on:
   push:
+    branches:
+      - main
     paths:
       - "**/*.md"
       - ".markdownlint.json"
@@ -18,6 +20,8 @@ jobs:
   lint:
 
     runs-on: ubuntu-latest
+    permissions:
+        statuses: write
 
     steps:
     - uses: actions/checkout@a81bbbf8298c0fa03ea29cdc473d45769f953675 #@v2

.github/workflows/version-sweep.yml

@@ -4,7 +4,7 @@ name: 'target supported version'
 
 # Controls when the action will run. 
 on:
-  # Triggers the workflow on push or pull request event based on a schedule
+  # Triggers the workflow on push or pull request events but only for the default branch
   schedule:
   - cron: '0 0 1 * *'
   workflow_dispatch:
@@ -20,6 +20,9 @@ jobs:
   version-sweep:
     # The type of runner that the job will run on
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
@@ -31,6 +34,7 @@ jobs:
         if: ${{ github.event_name == 'workflow_dispatch' }}
         run: |
           echo 'Reason: ${{ github.event.inputs.reason }}'
+
       # Start the .NET version sweeper, scan projects/slns for non-LTS (or currrent) versions
       - name: .NET version sweeper
         id: dotnet-version-sweeper