ci(publish): narrow workflow-level permissions to contents: read

[hivecommons-hive]

Closes #304

Narrow the workflow-level permissions block to contents: read only, as the id-token: write permission is only required by the publish job, which already declares it in its job-level permissions. This reduces the attack surface by ensuring other jobs like verify-tag do not receive unnecessary OIDC-capable tokens.

All jobs retain their required permissions:

• verify-tag: Uses workflow-level contents: read
• publish: Uses job-level contents: read and id-token: write
• release: Uses job-level contents: write

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

hive/awaiting-ci: CI pending — sweep will merge when green.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

dfe95eb

ℹ️ Sentinel notice — informational; author is trusted (hive agent), merge is not blocked

Hive flagged this PR (author @hivecommons-hive[bot], head dfe95eb87968) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/publish.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

Looks correct to me; routing to a maintainer because it edits workflow permissions.

Verified at head dfe95eb in .github/workflows/publish.yml:

• Workflow-level block (lines 9–10) is now contents: read only; id-token: write removed.
• publish job (lines 50–52) still declares contents: read + id-token: write at job level, so npm provenance/OIDC publishing is unaffected.
• release job (lines 99–100) keeps contents: write for creating the GitHub release.
• verify-tag (line 13) declares no job-level block and inherits contents: read — it only checks out and inspects the tag, so that is sufficient.

Net effect: verify-tag loses an OIDC-capable token it never used. No job loses a permission it needs. Author is the hive App bot; the change is a strict tightening.

Workflow permissions: is a trust surface, so I'm not calling this settled on my own.

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Needs a decision, not a merge:

• the reviewer swarm returned requires_human @dfe95eb
• reviewer question: @clubanderson please confirm the publish workflow permissions narrowing (id-token: write moved from workflow-level to publish job only) is acceptable to merge.
• the automerge lane will not merge this unattended

Head: verdict requires_human @dfe95eb, 7/7 checks green, DCO yes, soak 0s of 30m0s.

_{Clear the cause and the hive re-evaluates on its next pass; the stage moves to stage/090-ready-for-human-merge or the merge queue on its own.}

[clubanderson]

Confirmed — narrowing workflow-level permissions to contents: read is acceptable; publish job retains job-level id-token: write with environment npm, so OIDC publishing is unaffected.

[clubanderson]

/hive decision Confirmed — narrowing workflow-level permissions to contents: read is acceptable; publish job retains job-level id-token: write with environment npm, so OIDC publishing is unaffected. Merge.

/lgtm
/approve

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: 63f07436ada84fc218c8704fd4ffe076afd58cc6

[kubestellar-prow]

LGTM label has been added.

Details

Git tree hash: 63f07436ada84fc218c8704fd4ffe076afd58cc6

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: clubanderson

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Evidence bundle `#305dfe95eb` sha256:08f3f2435d7513bb18d32e30d7357d877384fb2a6fe29806758bd4c4229dea1f — download from the dashboard or `hivectl review evidence #305`.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback