Verify Workflow Security (Permissions and App ID Verification)

Phase: ongoing (close when all workflows are implemented and verified)
Labels: quartz, security
Blocked by: Phase 1 B+C (receive-therock-data.yml), Phase 2 A (notify-downstream.yml, receive-downstream-data.yml)

Context

The repository default is set to read-all in Phase 1 A1, with job-level permission
elevation stubs added as placeholders. This issue tracks verification that all
workflows have the correct minimal permissions once they are fully implemented.

Reference: RFC-0011 (ROCm/TheRock#3728 / docs/rfcs/RFC0011-Quartz-CICD-Datahub.md in ROCm/TheRock once merged) — Security Considerations.

Tasks

• receive-therock-data.yml: verify job-level elevation is contents: write +
  issues: write and nothing more
• notify-downstream.yml: verify no elevation beyond read-all default
• receive-downstream-data.yml: verify job-level elevation is issues: write
  and nothing more
• Confirm no workflow step or script acquires permissions beyond what is declared
• Verify that all workflow_dispatch workflows in ROCm/quartz perform GitHub App
  ID verification (github.event.installation.id) as their first step before any
  processing — covers receive-therock-data.yml and receive-downstream-data.yml
• Close this issue only after all three workflows are fully implemented and reviewed

Read RFC-0011's Security Considerations, then inspect receive-therock-data.yml, notify-downstream.yml, and receive-downstream-data.yml once the listed blocking workflows are implemented. Verify each declared permission, check that workflow_dispatch App ID verification is first where required, and confirm no step or script exceeds those permissions before closing the issue.