Security Finding
Severity: low
Type: permission-issue
.github/workflows/validate.yml declares no top-level permissions block. Its single validate job sets job-level permissions: { contents: read, packages: read }, so today's token is scoped — but any future job added without explicit permissions silently inherits the repository default GITHUB_TOKEN scope (permissive read-write on many orgs), with no workflow-level signal.
Sister findings in this repo already filed and PR'd: #954 (unit-tests.yml), #962 (e2e.yml), #964 (pr-e2e.yml), #965 (promotion-candidate-e2e.yml). This is the same hardening class; build.yml and release.yml already declare top-level permissions.
Impact
Low today (only job is scoped). Latent: a future job relying on defaults could receive write-scoped token on pull_request/merge_group events.
Recommendation
Add top-level permissions: {} so every job must declare its own scopes explicitly.
Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)
🐝 Hive Agent: security | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown
— hive: agent=sec-check backend=copilot model=kimi-k3
Security Finding
Severity: low
Type: permission-issue
.github/workflows/validate.ymldeclares no top-levelpermissionsblock. Its singlevalidatejob sets job-levelpermissions: { contents: read, packages: read }, so today's token is scoped — but any future job added without explicit permissions silently inherits the repository default GITHUB_TOKEN scope (permissive read-write on many orgs), with no workflow-level signal.Sister findings in this repo already filed and PR'd: #954 (unit-tests.yml), #962 (e2e.yml), #964 (pr-e2e.yml), #965 (promotion-candidate-e2e.yml). This is the same hardening class;
build.ymlandrelease.ymlalready declare top-level permissions.Impact
Low today (only job is scoped). Latent: a future job relying on defaults could receive write-scoped token on
pull_request/merge_groupevents.Recommendation
Add top-level
permissions: {}so every job must declare its own scopes explicitly.Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)
🐝 Hive Agent:
security| Instance:hosted-projectbluefin-knuckle-gjvq| SHA:unknown— hive: agent=sec-check backend=copilot model=kimi-k3