From ad2ee951e5c54580575bc082c4135d0050b20f15 Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 10:38:37 +0000
Subject: [PATCH] Scope GITHUB_TOKEN permissions per job

A job with no `permissions:` block inherits whatever the repository
hands out. Each block added here grants what that job's own steps
need and nothing more.
---
 .github/workflows/discovery-catalog.yml  |  6 ++++--
 .github/workflows/package-ci.yml         |  6 ++++--
 .github/workflows/publish-pypi.yml       |  6 ++++--
 .github/workflows/publish-testpypi.yml   |  6 ++++--
 .github/workflows/test.yml               | 12 ++++++++++++
 .github/workflows/validation-runtime.yml |  6 ++++--
 6 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/discovery-catalog.yml b/.github/workflows/discovery-catalog.yml
index 8d13b5f744..83a5781bff 100644
--- a/.github/workflows/discovery-catalog.yml
+++ b/.github/workflows/discovery-catalog.yml
@@ -19,11 +19,13 @@ on:
       - .github/workflows/discovery-catalog.yml
   workflow_dispatch:
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   snapshot:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/package-ci.yml b/.github/workflows/package-ci.yml
index 854aef5b37..8b4013fee8 100644
--- a/.github/workflows/package-ci.yml
+++ b/.github/workflows/package-ci.yml
@@ -10,11 +10,13 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   package:
+    permissions:
+      contents: read
     name: Build and smoke-test package
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 814418e917..f76b54dcbf 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -9,8 +9,6 @@ on:
     tags:
       - "v*.*.*"
 
-permissions:
-  contents: read
 
 concurrency:
   group: openenv-package-publish
@@ -19,8 +17,12 @@ concurrency:
 env:
   PACKAGE_NAME: openenv
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build release distribution
     runs-on: ubuntu-latest
     outputs:
diff --git a/.github/workflows/publish-testpypi.yml b/.github/workflows/publish-testpypi.yml
index 095147ef0b..1b255f8bb3 100644
--- a/.github/workflows/publish-testpypi.yml
+++ b/.github/workflows/publish-testpypi.yml
@@ -12,8 +12,6 @@ on:
         required: false
         type: string
 
-permissions:
-  contents: read
 
 concurrency:
   group: openenv-package-publish
@@ -22,8 +20,12 @@ concurrency:
 env:
   PACKAGE_NAME: openenv
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build TestPyPI distribution
     runs-on: ubuntu-latest
     outputs:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fe652ba98c..34714a02aa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,8 +13,12 @@ on:
 env:
   UV_VERSION: "0.9.3"
 
+permissions: {}
+
 jobs:
   validate-env-locks:
+    permissions:
+      contents: read
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
 
@@ -61,6 +65,8 @@ jobs:
           done
 
   test:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -97,6 +103,8 @@ jobs:
           PYTHONPATH: src:envs
 
   test-thinkingbox-env:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -131,6 +139,8 @@ jobs:
           PYTHONPATH: src:envs
 
   check-env-docs:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -145,6 +155,8 @@ jobs:
         run: python scripts/sync_env_docs.py --check
 
   lint:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
diff --git a/.github/workflows/validation-runtime.yml b/.github/workflows/validation-runtime.yml
index d4a9aebb6c..4034353533 100644
--- a/.github/workflows/validation-runtime.yml
+++ b/.github/workflows/validation-runtime.yml
@@ -6,11 +6,13 @@ on:
     branches: [main]
   workflow_dispatch:
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   runtime:
+    permissions:
+      contents: read
     name: Runtime validation / Linux Docker
     runs-on: ubuntu-24.04
     timeout-minutes: 30