From 6d31381dd74e317a45b5c0f44f6ba1da42e7dff1 Mon Sep 17 00:00:00 2001 From: Ray Ketcham Date: Sun, 19 Apr 2026 23:12:24 +0000 Subject: [PATCH 1/2] security: add workflow permissions for least privilege Co-Authored-By: Claude --- .github/workflows/ci.yml | 3 +++ .github/workflows/daily.yml | 3 +++ .github/workflows/encryption-enforcement.yml | 3 +++ .github/workflows/pii-scan.yml | 3 +++ .github/workflows/security-review.yml | 3 +++ .github/workflows/security.yml | 3 +++ .github/workflows/traceability.yml | 3 +++ 7 files changed, 21 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d400ec0..1e2d31b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: org-guard: name: Verify Repository Organization diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml index 3b89f03..372164a 100644 --- a/.github/workflows/daily.yml +++ b/.github/workflows/daily.yml @@ -5,6 +5,9 @@ on: - cron: '0 7 * * *' # Daily at 07:00 UTC workflow_dispatch: +permissions: + contents: read + jobs: org-guard: name: Verify Repository Organization diff --git a/.github/workflows/encryption-enforcement.yml b/.github/workflows/encryption-enforcement.yml index ca696f8..5067e91 100644 --- a/.github/workflows/encryption-enforcement.yml +++ b/.github/workflows/encryption-enforcement.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: encryption-tests: name: Encryption & Security Tests diff --git a/.github/workflows/pii-scan.yml b/.github/workflows/pii-scan.yml index e2d4754..2e2018d 100644 --- a/.github/workflows/pii-scan.yml +++ b/.github/workflows/pii-scan.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: pii-scan: name: Scan for PII and secrets diff --git a/.github/workflows/security-review.yml b/.github/workflows/security-review.yml index 0862a26..6eb2e5b 100644 --- a/.github/workflows/security-review.yml +++ b/.github/workflows/security-review.yml @@ -9,6 +9,9 @@ on: - cron: '0 6 * * *' # Daily at 06:00 UTC workflow_dispatch: +permissions: + contents: read + jobs: org-guard: name: Verify Repository Organization diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d039590..328abe0 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -6,6 +6,9 @@ on: pull_request: branches: [main] +permissions: + contents: read + jobs: org-guard: name: Verify Repository Organization diff --git a/.github/workflows/traceability.yml b/.github/workflows/traceability.yml index c484819..d41c3a4 100644 --- a/.github/workflows/traceability.yml +++ b/.github/workflows/traceability.yml @@ -17,6 +17,9 @@ on: description: 'Flag issues with no linked commit after N days' default: '7' +permissions: + contents: read + jobs: # ── 1:1 minimum — every PR/push must reference an issue ────────────── commit-references-issue: From ce71ca459dd80ac1c7a8e812324a85fe0f00515b Mon Sep 17 00:00:00 2001 From: Ray Ketcham Date: Wed, 22 Apr 2026 00:50:08 +0000 Subject: [PATCH 2/2] security: add issues/pull-requests read to traceability workflow The traceability workflow uses gh issue list and gh pr list, which require issues: read and pull-requests: read permissions beyond the contents: read added in the prior commit. Co-Authored-By: Claude --- .github/workflows/traceability.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/traceability.yml b/.github/workflows/traceability.yml index d41c3a4..e70055d 100644 --- a/.github/workflows/traceability.yml +++ b/.github/workflows/traceability.yml @@ -19,6 +19,8 @@ on: permissions: contents: read + issues: read + pull-requests: read jobs: # ── 1:1 minimum — every PR/push must reference an issue ──────────────