From 0d66cb361aa8c24d9e605f1e2d04c1439e627204 Mon Sep 17 00:00:00 2001
From: "Joseph T. French" <joey@harbinger.finance>
Date: Thu, 27 Aug 2026 17:09:54 -0500
Subject: [PATCH] chore(ci): declare explicit GITHUB_TOKEN permissions on
 unscoped jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the three open `actions/missing-workflow-permissions` code scanning
alerts. The org and repo defaults are already read-only, so this is
defense-in-depth rather than a live over-grant — but it stops the workflows
depending on a setting that could be flipped later.

- test: contents: read. The job only checks out the repo, but `npm install`
  executes arbitrary postinstall scripts, so pinning the scope explicitly is
  the one that carries real weight.
- create-release: contents: write. CodeQL suggests `contents: read` here, but
  the job pushes the version commit to main and creates the release branch;
  read would break the `secrets.ACTIONS_TOKEN || github.token` fallback.
- create-summary: {}. Only writes to $GITHUB_STEP_SUMMARY.
---
 .github/workflows/create-release.yml | 9 +++++++++
 .github/workflows/test.yml           | 5 +++++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index b3245cf..c7d928b 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -16,6 +16,12 @@ on:
 jobs:
   create-release:
     runs-on: ubuntu-latest
+
+    # Pushes the version commit to main and creates the release branch. Needed
+    # for the `|| github.token` fallback when ACTIONS_TOKEN is unset.
+    permissions:
+      contents: write
+
     outputs:
       new_version: ${{ steps.new-version.outputs.new_version }}
       branch_name: ${{ steps.new-version.outputs.branch_name }}
@@ -130,6 +136,9 @@ jobs:
     needs: [create-release, create-tag]
     if: always()
     runs-on: ubuntu-latest
+
+    # Only writes to $GITHUB_STEP_SUMMARY; needs no token scopes at all.
+    permissions: {}
     steps:
       - name: Create summary
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ee0aa37..943b10d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,6 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
 
+    # Only reads the repo; npm install runs arbitrary postinstall scripts, so
+    # keep the token scoped down regardless of the org-wide default.
+    permissions:
+      contents: read
+
     # 22 is the oldest Node still in support; 24 is the LTS the consuming
     # apps now run on. Testing only the newest would leave consumers on 22
     # unverified. Node 18 is omitted despite engines.node — it went EOL in