ci: add least-privilege permissions to GitHub Actions workflows

.github/workflows/ci.yml

@@ -12,6 +12,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   test-build:
     name: 👷 Test & Build ${{ matrix.goVer }}${{ matrix.label }}

.github/workflows/lint.yml

@@ -6,6 +6,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: 👮 Lint

.github/workflows/reviewdog.yml

@@ -6,6 +6,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  pull-requests: write
+
 jobs:
   reviewdog:
     name: 🐶 Reviewdog

.github/workflows/scheduled_test.yml

@@ -6,6 +6,9 @@ on:
     # Monday at 9:00 UTC
     - cron: "0 9 * * 1"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest

chat_channel_integration_test.go

@@ -129,13 +129,21 @@ func TestChatChannelIntegration(t *testing.T) {
 		assert.Equal(t, "red", resp.Data.Channel.Custom["color"])
 
 		// Unset fields
-		resp, err = ch.UpdateChannelPartial(ctx, &UpdateChannelPartialRequest{
+		_, err = ch.UpdateChannelPartial(ctx, &UpdateChannelPartialRequest{
 			Unset: []string{"color"},
 		})
 		require.NoError(t, err)
-		require.NotNil(t, resp.Data.Channel)
-		_, hasColor := resp.Data.Channel.Custom["color"]
-		assert.False(t, hasColor, "color should be unset")
+
+		// The response can be hydrated from a read replica that has not observed
+		// the write yet, so re-read until the unset field disappears.
+		require.Eventually(t, func() bool {
+			resp, err := ch.GetOrCreate(ctx, &GetOrCreateChannelRequest{})
+			if err != nil || resp.Data.Channel == nil {
+				return false
+			}
+			_, hasColor := resp.Data.Channel.Custom["color"]
+			return !hasColor
+		}, 5*time.Second, 500*time.Millisecond, "color should be unset")
 	})
 
 	t.Run("DeleteChannel", func(t *testing.T) {