From 2694518cbabddcb5d70a2c9588a1b3c2face9c9d Mon Sep 17 00:00:00 2001
From: Arpit Jain <arpitjain099@gmail.com>
Date: Fri, 15 May 2026 07:41:08 +0900
Subject: [PATCH] ci: declare workflow-level contents: read on 6 lint/build
 workflows

Pins the default GITHUB_TOKEN to contents: read on the 6 workflows in
.github/workflows/ that don't actually need any write scope:

- code-format.yml: prettier/clang-format check.
- compiler-rs.yml: rust compiler build.
- compiler.test.yml: spec compiler test matrix.
- license.yml: license header check.
- linter.yml: spec linter.
- metamodel-sync.yml: copies compiler metamodel to ts generator and
  checks they're in sync with git status --porcelain; no GitHub API
  beyond the initial checkout.

Left implicit on purpose:

- backport.yml is on pull_request_target with a backport action.
- generate.yml does git push.
- update-rest-api-json.yml uses peter-evans/create-pull-request.
- labeler.yml needs labeler write scope.

Those four are best declared by a maintainer.

Motivation: CVE-2025-30066 (March 2025 tj-actions/changed-files
compromise) exfiltrated GITHUB_TOKEN from workflow logs. Per-workflow
caps bound runtime authority irrespective of repo or org default,
give drift protection if the default ever widens, and are credited
per-file by the OpenSSF Scorecard Token-Permissions check.

YAML validated locally with yaml.safe_load.

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
---
 .github/workflows/code-format.yml    | 3 +++
 .github/workflows/compiler-rs.yml    | 3 +++
 .github/workflows/compiler.test.yml  | 3 +++
 .github/workflows/license.yml        | 3 +++
 .github/workflows/linter.yml         | 3 +++
 .github/workflows/metamodel-sync.yml | 3 +++
 6 files changed, 18 insertions(+)

diff --git a/.github/workflows/code-format.yml b/.github/workflows/code-format.yml
index c1afd709a3..4e650f3688 100644
--- a/.github/workflows/code-format.yml
+++ b/.github/workflows/code-format.yml
@@ -2,6 +2,9 @@ name: Code style
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/compiler-rs.yml b/.github/workflows/compiler-rs.yml
index 1433bb0008..efed0c5a5a 100644
--- a/.github/workflows/compiler-rs.yml
+++ b/.github/workflows/compiler-rs.yml
@@ -6,6 +6,9 @@ on:
 env: 
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   build_and_test:
     name: compiler-rs
diff --git a/.github/workflows/compiler.test.yml b/.github/workflows/compiler.test.yml
index f93a2a2bc3..fa2072ea89 100644
--- a/.github/workflows/compiler.test.yml
+++ b/.github/workflows/compiler.test.yml
@@ -5,6 +5,9 @@ on:
     paths:
       - 'compiler/**'
 
+permissions:
+  contents: read
+
 jobs:
   compiler-test:
     name: build
diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index 1fb1849f9d..e04de1df48 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -2,6 +2,9 @@ name: License headers
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 846c329a74..08d221cda8 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -2,6 +2,9 @@ name: Linter
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/metamodel-sync.yml b/.github/workflows/metamodel-sync.yml
index be315516b8..413d78f847 100644
--- a/.github/workflows/metamodel-sync.yml
+++ b/.github/workflows/metamodel-sync.yml
@@ -6,6 +6,9 @@ on:
       - 'compiler/**'
       - 'typescript-generator/**'
 
+permissions:
+  contents: read
+
 jobs:
   build: