From ce2ac201d7c7473f4acc3e317c875e79816a4e53 Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 11:10:20 +0000
Subject: [PATCH] Scope GITHUB_TOKEN permissions per job

A job with no `permissions:` block inherits whatever the repository
hands out. Each block added here grants what that job's own steps
need and nothing more.
---
 .github/workflows/build_kernel.yaml            |  6 ++++++
 .github/workflows/build_kernel_cpu.yaml        |  4 ++++
 .github/workflows/build_kernel_macos.yaml      |  4 ++++
 .github/workflows/build_kernel_rocm.yaml       |  4 ++++
 .github/workflows/build_kernel_windows.yaml    |  4 ++++
 .github/workflows/build_kernel_xpu.yaml        |  4 ++++
 .github/workflows/check_variants.yaml          |  4 ++++
 .github/workflows/kernel-builder-cli-docs.yaml |  4 ++++
 .github/workflows/lint.yml                     |  8 ++++++++
 .github/workflows/nix_checks.yml               |  4 ++++
 .github/workflows/publish_kernels.yml          | 14 ++++++++++++--
 .github/workflows/rust.yaml                    |  8 ++++++++
 .github/workflows/test_e2e.yaml                |  7 +++++++
 .github/workflows/test_extra_commands.yaml     |  4 ++++
 .github/workflows/update_abi_symbols.yaml      |  6 ++++--
 .github/workflows/update_cache.yaml            |  4 ++++
 .github/workflows/vouch-check-pr.yaml          |  8 +++++---
 17 files changed, 90 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build_kernel.yaml b/.github/workflows/build_kernel.yaml
index eae52609e..347a08f85 100644
--- a/.github/workflows/build_kernel.yaml
+++ b/.github/workflows/build_kernel.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernels (${{ matrix.arch }})
     strategy:
       matrix:
@@ -67,6 +71,8 @@ jobs:
             silu-and-mul-kernel
 
   test:
+    permissions:
+      contents: read
     name: Test kernels (UBI ${{ matrix.ubi_version }})
     needs: build
     strategy:
diff --git a/.github/workflows/build_kernel_cpu.yaml b/.github/workflows/build_kernel_cpu.yaml
index 3114a58f2..018adea3b 100644
--- a/.github/workflows/build_kernel_cpu.yaml
+++ b/.github/workflows/build_kernel_cpu.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
diff --git a/.github/workflows/build_kernel_macos.yaml b/.github/workflows/build_kernel_macos.yaml
index b30862f5e..29c7a0c02 100644
--- a/.github/workflows/build_kernel_macos.yaml
+++ b/.github/workflows/build_kernel_macos.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on: macos-26
     steps:
diff --git a/.github/workflows/build_kernel_rocm.yaml b/.github/workflows/build_kernel_rocm.yaml
index 8f05922de..179c8d01a 100644
--- a/.github/workflows/build_kernel_rocm.yaml
+++ b/.github/workflows/build_kernel_rocm.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernels (ROCm)
     runs-on:
       group: aws-highmemory-32-plus-nix
diff --git a/.github/workflows/build_kernel_windows.yaml b/.github/workflows/build_kernel_windows.yaml
index 87b770408..6e7d46c4f 100644
--- a/.github/workflows/build_kernel_windows.yaml
+++ b/.github/workflows/build_kernel_windows.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ windows-2022 ]
diff --git a/.github/workflows/build_kernel_xpu.yaml b/.github/workflows/build_kernel_xpu.yaml
index e240aa2df..a17b14412 100644
--- a/.github/workflows/build_kernel_xpu.yaml
+++ b/.github/workflows/build_kernel_xpu.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
diff --git a/.github/workflows/check_variants.yaml b/.github/workflows/check_variants.yaml
index c51301e35..0b3fa86b9 100644
--- a/.github/workflows/check_variants.yaml
+++ b/.github/workflows/check_variants.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Check build variants
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/kernel-builder-cli-docs.yaml b/.github/workflows/kernel-builder-cli-docs.yaml
index c8c1884e9..dd99122c9 100644
--- a/.github/workflows/kernel-builder-cli-docs.yaml
+++ b/.github/workflows/kernel-builder-cli-docs.yaml
@@ -16,8 +16,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check-cli-docs:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 7bd7962be..398314d11 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,8 +14,12 @@ env:
   RUFF_VERSION: "0.15.10"
   GRIFFE_VERSION: "1.15.0"
 
+permissions: {}
+
 jobs:
   lint:
+    permissions:
+      contents: read
     name: Run lints
     runs-on: ubuntu-latest
     steps:
@@ -33,6 +37,8 @@ jobs:
           args: format --check
 
   griffe:
+    permissions:
+      contents: read
     name: Check API compatibility
     runs-on: ubuntu-latest
     env:
@@ -49,6 +55,8 @@ jobs:
         run: uvx griffe==${{ env.GRIFFE_VERSION }} check kernels --search kernels/src -a main
 
   validate-dependencies:
+    permissions:
+      contents: read
     name: Validate python_depends.json
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/nix_checks.yml b/.github/workflows/nix_checks.yml
index f0272cef4..d3f0b6433 100644
--- a/.github/workflows/nix_checks.yml
+++ b/.github/workflows/nix_checks.yml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Nix checks
     runs-on:
       group: aws-highmemory-32-plus-nix
diff --git a/.github/workflows/publish_kernels.yml b/.github/workflows/publish_kernels.yml
index 0c42f7f7f..55a2c51ff 100644
--- a/.github/workflows/publish_kernels.yml
+++ b/.github/workflows/publish_kernels.yml
@@ -35,11 +35,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   linux:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.platform.runner }}
     strategy:
       matrix:
@@ -84,6 +86,8 @@ jobs:
           path: dist
 
   musllinux:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.platform.runner }}
     strategy:
       matrix:
@@ -124,6 +128,8 @@ jobs:
           path: dist
 
   windows:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.platform.runner }}
     strategy:
       matrix:
@@ -170,6 +176,8 @@ jobs:
           path: dist
 
   macos:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.platform.runner }}
     strategy:
       matrix:
@@ -207,6 +215,8 @@ jobs:
           path: dist
 
   sdist:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
diff --git a/.github/workflows/rust.yaml b/.github/workflows/rust.yaml
index 02f19f22f..4b80f0a4c 100644
--- a/.github/workflows/rust.yaml
+++ b/.github/workflows/rust.yaml
@@ -11,8 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   fmt:
+    permissions:
+      contents: read
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
@@ -31,6 +35,8 @@ jobs:
         run: ( cd kernel-builder && cargo fmt --all -- --check )
 
   clippy:
+    permissions:
+      contents: read
     name: Clippy
     runs-on: ubuntu-latest
     steps:
@@ -58,6 +64,8 @@ jobs:
         run: ( cd kernel-builder && cargo clippy -- -D warnings )
 
   test:
+    permissions:
+      contents: read
     name: Test
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/test_e2e.yaml b/.github/workflows/test_e2e.yaml
index eed583c4c..520c3708a 100644
--- a/.github/workflows/test_e2e.yaml
+++ b/.github/workflows/test_e2e.yaml
@@ -25,8 +25,12 @@ env:
   E2E_REPO_NAME: kernels-e2e-${{ github.run_id }}-${{ github.run_attempt }}
   E2E_PKG_NAME: kernels_e2e_${{ github.run_id }}_${{ github.run_attempt }}
 
+permissions: {}
+
 jobs:
   init-build-upload:
+    permissions:
+      contents: read
     name: Init, build, and upload kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
@@ -109,6 +113,8 @@ jobs:
           nix run $GITHUB_WORKSPACE#kernel-builder -- upload /tmp/${{ env.E2E_REPO_NAME }} --repo-type model
 
   download-and-test:
+    permissions:
+      contents: read
     name: Download and test kernel via get_kernel
     needs: init-build-upload
     runs-on:
@@ -153,6 +159,7 @@ jobs:
           "
 
   cleanup:
+    permissions: {}
     name: Clean up test repos
     needs: [init-build-upload, download-and-test]
     if: always()
diff --git a/.github/workflows/test_extra_commands.yaml b/.github/workflows/test_extra_commands.yaml
index 7984f5708..2e99a4ad9 100644
--- a/.github/workflows/test_extra_commands.yaml
+++ b/.github/workflows/test_extra_commands.yaml
@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/update_abi_symbols.yaml b/.github/workflows/update_abi_symbols.yaml
index e55a1d155..38392aae3 100644
--- a/.github/workflows/update_abi_symbols.yaml
+++ b/.github/workflows/update_abi_symbols.yaml
@@ -10,11 +10,13 @@ concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   update:
+    permissions:
+      contents: read
     name: Refresh vendored ABI symbol files
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/update_cache.yaml b/.github/workflows/update_cache.yaml
index e6423e15a..183ff0b24 100644
--- a/.github/workflows/update_cache.yaml
+++ b/.github/workflows/update_cache.yaml
@@ -8,8 +8,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Update Nix builder cache (${{ matrix.arch }})
     strategy:
       matrix:
diff --git a/.github/workflows/vouch-check-pr.yaml b/.github/workflows/vouch-check-pr.yaml
index 08c3c0671..ad57e3a0e 100644
--- a/.github/workflows/vouch-check-pr.yaml
+++ b/.github/workflows/vouch-check-pr.yaml
@@ -3,12 +3,14 @@ on:
   pull_request_target:
     types: [opened, reopened]
 
-permissions:
-  contents: read
-  pull-requests: write
+
+permissions: {}
 
 jobs:
   check:
+    permissions:
+      contents: read
+      pull-requests: write
     name: Check PR author
     runs-on: ubuntu-latest
     steps: