From c35118be40d196fc65d9dea42af226d84d474da6 Mon Sep 17 00:00:00 2001
From: Sythos <sythos@gmail.com>
Date: Tue, 25 Aug 2026 21:47:54 +0200
Subject: [PATCH] fix: keep PR provenance checks least privilege

---
 .github/workflows/pr-validation.yml | 2 --
 .github/workflows/quality-gates.yml | 9 ++-------
 README.md                           | 2 +-
 3 files changed, 3 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 6ada2e4..1438d54 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -24,8 +24,6 @@ on:
 
 permissions:
   contents: read
-  id-token: write
-  attestations: write
 
 concurrency:
   group: pr-validation-${{ github.event.pull_request.number || github.ref }}
diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml
index 4d2b582..5cb6895 100644
--- a/.github/workflows/quality-gates.yml
+++ b/.github/workflows/quality-gates.yml
@@ -17,11 +17,6 @@ on:
         default: amd64
         type: string
 
-permissions:
-  contents: read
-  id-token: write
-  attestations: write
-
 jobs:
   repository-quality:
     name: Repository quality gates (${{ inputs.context }})
@@ -169,8 +164,8 @@ jobs:
           grep -Fq 'architecture_mode' .github/workflows/pr-validation.yml
           grep -Fq 'BUILD_PLATFORMS' .github/workflows/quality-gates.yml
           grep -Fq 'uses: actions/attest-build-provenance@v4' .github/workflows/quality-gates.yml
-          grep -Fq 'id-token: write' .github/workflows/quality-gates.yml
-          grep -Fq 'attestations: write' .github/workflows/quality-gates.yml
+          grep -Fq 'id-token: write' .github/workflows/commit-tests.yml
+          grep -Fq 'attestations: write' .github/workflows/commit-tests.yml
           test -f src/dav/caldav/caldav-contract.mjs
           test -f src/dav/caldav/caldav-contract.test.mjs
           test -f src/dav/carddav/carddav-store.mjs
diff --git a/README.md b/README.md
index 90ddd8f..b6390b0 100644
--- a/README.md
+++ b/README.md
@@ -94,7 +94,7 @@ of production capacity or external service interoperability.
 - [x] fast amd64-first CI with an explicit multiarch amd64+arm64 final gate;
 - [x] tenant-bound DAV ETags and sync tokens;
 - [x] OCI build-provenance attestations generated and verified;
-- [x] pull-request validation delegates the identity-token and attestation permissions required by the provenance gate;
+- [x] provenance permissions are granted only by push or manual callers, while pull-request validation remains read-only;
 - [x] log rotation;
 - [x] alerts;
 - [x] Postfix queue visibility;