From 52be7ce1f892f935c58988f965c5db29f3b99d0f Mon Sep 17 00:00:00 2001 From: arena-agent Date: Sun, 27 Sep 2026 10:17:02 +0000 Subject: [PATCH] ci: declare least-privilege token scope for the estate audit workflow main-estate-audit.yml was the only workflow in .github/workflows/ with no `permissions:` block, so its GITHUB_TOKEN inherited the repository-default scopes. Every one of its 27 steps is a shell gate over the checked-out tree; none of the cicd-suite composite actions take a token or call the GitHub API. `contents: read` is therefore the complete grant, and declaring it brings this file in line with the other 15 workflows in the directory. Verified with the official GitHub Actions workflow JSON schema (16/16 pass) and actionlint 2.0.6 (no new findings). Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com> --- .github/workflows/main-estate-audit.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml index 33d8b40e..ddce727a 100644 --- a/.github/workflows/main-estate-audit.yml +++ b/.github/workflows/main-estate-audit.yml @@ -10,6 +10,14 @@ on: pull_request: branches: [ "main" ] +# Least privilege. Every step below is a shell gate over the checked-out +# working tree: none of the cicd-suite composite actions take a token or call +# the GitHub API, so `contents: read` is the complete grant. Declaring it here +# stops this workflow inheriting the repository-default GITHUB_TOKEN scopes, +# which is what the other 15 workflows in this directory already do. +permissions: + contents: read + jobs: estate-audit: runs-on: ubuntu-latest