[CI][Security] SEC-00864: Least-privilege secrets & permissions in AMD CI workflows (amd-staging)

[vkallesh]

Summary

Ports the SEC-00864 fix from the release branch (#3044) onto the active amd-staging trunk so the hardening lands in mainline and does not regress.

Addresses Mythos AI finding SEC-00864 (High) — Excessive Secret Inheritance and Missing Permissions in GitHub Actions Workflows.

1. Excessive secret inheritance. Reusable-workflow calls used secrets: inherit, handing every repository secret to child workflows even though almost none are used. Audit of the build/test tree shows the only consumed secrets are BENCHMARK_DB_URL / BENCHMARK_DB_FALLBACK_URL (test_component.yml) and AMD_STAGING_NIGHTLY_TEAMS_WEBHOOK_URL (teams_notifier.yml). Everything else uses OIDC (id-token) or the auto-provided GITHUB_TOKEN.
2. Missing top-level permissions. Three AMD trigger workflows had no permissions: block.

Changes

• Declared BENCHMARK_DB_URL / BENCHMARK_DB_FALLBACK_URL as optional workflow_call secrets in test_component.yml and test_benchmarks.yml.
• Forwarded only those two secrets by name on the benchmark path: ci_windows.yml → test_benchmarks.yml → test_component.yml.
• In ci_nightly.yml, forwarded only the already-declared AMD_STAGING_NIGHTLY_TEAMS_WEBHOOK_URL to teams_notifier.yml (instead of inheriting everything).
• Removed unused secrets: inherit from build/test chains that consume no secrets: ci_linux.yml, ci_nightly.yml→ci_linux, ci_asan.yml, multi_arch_ci.yml, and the Windows build call site.
• Added permissions: contents: read to PSDB-amd-staging.yml, buildbot-psdb-trigger.yml, compute-rocm-dkmd-afar-trigger.yml.

Scope note

This is a faithful 1:1 port of the workflows covered by #3044. amd-staging is the active trunk and contains additional trunk-only workflows that also use secrets: inherit (spirv-ci, multi_arch_release*, rockci_* variants, parameterised-sha-*). Those are intentionally out of scope here and can be hardened in a follow-up if desired.

Why this is safe

• Removing secrets: inherit does not affect GITHUB_TOKEN (always auto-provided) or OIDC (id-token), which the build jobs rely on.
• Benchmark DB secrets are required: false, preserving the existing "fail gracefully / skip submission" behavior.
• The entire multi_arch_ci → multi_arch_build_portable_linux → *_artifacts chain is build-only (AWS via OIDC), so it needs no inherited secrets.

Test plan

• pull_request to amd-staging still triggers the PSDB Jenkins job.
• Nightly (ci_nightly) Linux + Windows build/test pass; benchmark DB submission works on the Windows benchmark path; Teams notification is delivered.
• ci_asan and multi_arch_ci runs build successfully.
• buildbot / afar trigger workflows still trigger their Buildbot/Jenkins jobs.

Made with Cursor