Context: .github/workflows/nightly-security-audit.yml sets broad GitHub token scopes including contents: write for a job that only needs to run tests/audit and optionally upload artifacts.
Problem: A compromised or maliciously-modified step in the nightly job could push to the repo (contents: write) - exactly the privilege escalation chains security audits aim to avoid; write-overread permissions also complicate review of the shared token.
Proposed approach: Restrict to least privilege: permissions: { contents: read, security-events: write, pull-requests: none } (or [none] + artifact upload scope), and rely on artifacts for evidence.
Acceptance criteria: workflow.yml shows least-privilege permissions; a PR that re-adds write is caught by review.
Context:
.github/workflows/nightly-security-audit.ymlsets broad GitHub token scopes includingcontents: writefor a job that only needs to run tests/audit and optionally upload artifacts.Problem: A compromised or maliciously-modified step in the nightly job could push to the repo (contents: write) - exactly the privilege escalation chains security audits aim to avoid; write-overread permissions also complicate review of the shared token.
Proposed approach: Restrict to least privilege:
permissions: { contents: read, security-events: write, pull-requests: none }(or[none]+ artifact upload scope), and rely on artifacts for evidence.Acceptance criteria: workflow.yml shows least-privilege permissions; a PR that re-adds
writeis caught by review.