From 5c1e85acf0b626f22777342419ff33c66c912444 Mon Sep 17 00:00:00 2001 From: Manvendra Date: Thu, 9 Jul 2026 00:20:50 +0530 Subject: [PATCH] ci(security): add a least-privilege permissions block to sync-check sync-check.yml declared no `permissions:`, so it inherited the repository's default GITHUB_TOKEN scope -- read/write across contents, issues, and packages on older repo settings. All three of its jobs only check out the repo and run npm; none writes a comment, a commit, or a release. release.yml already scopes itself to `contents: write` because it genuinely creates a Release. sync-check needs strictly less: `contents: read`. Worth naming: this repo ships an infra-config-reviewer agent whose stated job is flagging "over-broad permissions" in CI/CD workflow config, and a supply-chain-security skill. A missing permissions block is the first thing either would report about this workflow. --- .github/workflows/sync-check.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/sync-check.yml b/.github/workflows/sync-check.yml index af24a5a..66e9b99 100644 --- a/.github/workflows/sync-check.yml +++ b/.github/workflows/sync-check.yml @@ -6,6 +6,14 @@ on: pull_request: branches: [main, dev] +# Least privilege. Every job here only checks out the repo and runs npm — none +# writes a comment, a commit, or a release. Without this block the workflow +# inherits the repository's default GITHUB_TOKEN scope, which on older repo +# settings is read/write across contents, issues, packages, and more. See +# release.yml, which asks for `contents: write` because it genuinely needs it. +permissions: + contents: read + jobs: sync-determinism: name: Sync determinism