Release Python SDK v17.0.0

[idimov-keeper]

• Bump up version to 17.0.0
• KSM-566 - Added parsing for KSM tokens with prefix
• KSM-628 - Added GraphSync links
• KSM-631 - Added links2Remove parameter for files removal
• KSM-635 - HTTPError should include response object
• Fixed test for new hard-coded client version

[socket-security]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request

To resolve the issue, you should explicitly declare the permissions: block at the root of the workflow. This will apply to all jobs unless they override it themselves. The minimal required permission for most jobs that only need to check out code is contents: read. Unless a job requires more (e.g., to create releases or modify issues/pull-requests), contents: read is sufficient and safe.

How to fix:

• At the very top level of .github/workflows/publish.pypi.sdk.yml (below the name: field, and usually above or below the on: field), add:

  permissions:
    contents: read

• If later you discover some jobs need more, you can add a more specific permissions: block under that job.

What to change:

• Only edit the workflow YAML as described, no additional methods, imports, or definitions are needed.

---

To address the issue, we should add a permissions: block at the workflow root (so it applies to all jobs) with the minimum permissions required for these jobs. Given the actions performed, many jobs likely only require contents: read (for reading source code), while only those jobs that need to push, create releases, etc. would require elevated write permissions. Since the provided block does not show jobs requiring write actions, a minimal permissions: is sufficient. The fix is to insert, after the name: and on: blocks (before jobs:), a permissions: block such as:

permissions:
  contents: read

This limits GITHUB_TOKEN to read-only access to repository contents (source code, etc.), following least privilege principles. If additional permissions are later needed by specific jobs, they can override this at the job level.

Steps:

• Insert a permissions: block after the name: and on: blocks, before jobs:.
• Use the minimal set (contents: read).

---

To fix this problem, the workflow file should have an explicit permissions key defined, either at the top (workflow-level, applies to all jobs unless they override) or on each job as required. Since most of these jobs are using basic tasks and do not appear to push or create content or releases, the minimum necessary is usually contents: read. This setting adheres to the principle of least privilege for most CI workflows.
How to fix:

• Add the following block at the top (for root-level, applies to all jobs):

  permissions:
    contents: read

• Insert this block after the workflow name and on: section (i.e., before jobs:).

Implementation steps:

• Edit .github/workflows/publish.pypi.sdk.yml.
• Insert the above lines between lines 3 and 5 (after the last on: line, before jobs:).
• No other changes are required unless further restrictions are desired for individual jobs.

---