Scope GITHUB_TOKEN permissions per job

.github/workflows/build_kernel.yaml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernels (${{ matrix.arch }})
     strategy:
       matrix:
@@ -67,6 +71,8 @@ jobs:
             silu-and-mul-kernel
 
   test:
+    permissions:
+      contents: read
     name: Test kernels (UBI ${{ matrix.ubi_version }})
     needs: build
     strategy:

.github/workflows/build_kernel_cpu.yaml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on:
       group: aws-highmemory-32-plus-nix

.github/workflows/build_kernel_macos.yaml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on: macos-26
     steps:

.github/workflows/build_kernel_rocm.yaml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernels (ROCm)
     runs-on:
       group: aws-highmemory-32-plus-nix

.github/workflows/build_kernel_windows.yaml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       matrix:
         os: [ windows-2022 ]

.github/workflows/build_kernel_xpu.yaml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on:
       group: aws-highmemory-32-plus-nix

.github/workflows/check_variants.yaml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Check build variants
     runs-on: ubuntu-latest
     steps:

.github/workflows/kernel-builder-cli-docs.yaml

@@ -16,8 +16,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   check-cli-docs:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

.github/workflows/lint.yml

@@ -14,8 +14,12 @@ env:
   RUFF_VERSION: "0.15.10"
   GRIFFE_VERSION: "1.15.0"
 
+permissions: {}
+
 jobs:
   lint:
+    permissions:
+      contents: read
     name: Run lints
     runs-on: ubuntu-latest
     steps:
@@ -33,6 +37,8 @@ jobs:
           args: format --check
 
   griffe:
+    permissions:
+      contents: read
     name: Check API compatibility
     runs-on: ubuntu-latest
     env:
@@ -49,6 +55,8 @@ jobs:
         run: uvx griffe==${{ env.GRIFFE_VERSION }} check kernels --search kernels/src -a main
 
   validate-dependencies:
+    permissions:
+      contents: read
     name: Validate python_depends.json
     runs-on: ubuntu-latest
     steps:

.github/workflows/nix_checks.yml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Nix checks
     runs-on:
       group: aws-highmemory-32-plus-nix

.github/workflows/publish_kernels.yml

@@ -35,11 +35,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   linux:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.platform.runner }}
     strategy:
       matrix:
@@ -84,6 +86,8 @@ jobs:
           path: dist
 
   musllinux:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.platform.runner }}
     strategy:
       matrix:
@@ -124,6 +128,8 @@ jobs:
           path: dist
 
   windows:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.platform.runner }}
     strategy:
       matrix:
@@ -170,6 +176,8 @@ jobs:
           path: dist
 
   macos:
+    permissions:
+      contents: read
     runs-on: ${{ matrix.platform.runner }}
     strategy:
       matrix:
@@ -207,6 +215,8 @@ jobs:
           path: dist
 
   sdist:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/rust.yaml

@@ -11,8 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   fmt:
+    permissions:
+      contents: read
     name: Rustfmt
     runs-on: ubuntu-latest
     steps:
@@ -31,6 +35,8 @@ jobs:
         run: ( cd kernel-builder && cargo fmt --all -- --check )
 
   clippy:
+    permissions:
+      contents: read
     name: Clippy
     runs-on: ubuntu-latest
     steps:
@@ -58,6 +64,8 @@ jobs:
         run: ( cd kernel-builder && cargo clippy -- -D warnings )
 
   test:
+    permissions:
+      contents: read
     name: Test
     runs-on: ubuntu-latest
     steps:

.github/workflows/test_e2e.yaml

@@ -25,8 +25,12 @@ env:
   E2E_REPO_NAME: kernels-e2e-${{ github.run_id }}-${{ github.run_attempt }}
   E2E_PKG_NAME: kernels_e2e_${{ github.run_id }}_${{ github.run_attempt }}
 
+permissions: {}
+
 jobs:
   init-build-upload:
+    permissions:
+      contents: read
     name: Init, build, and upload kernel
     runs-on:
       group: aws-highmemory-32-plus-nix
@@ -109,6 +113,8 @@ jobs:
           nix run $GITHUB_WORKSPACE#kernel-builder -- upload /tmp/${{ env.E2E_REPO_NAME }} --repo-type model
 
   download-and-test:
+    permissions:
+      contents: read
     name: Download and test kernel via get_kernel
     needs: init-build-upload
     runs-on:
@@ -153,6 +159,7 @@ jobs:
           "
 
   cleanup:
+    permissions: {}
     name: Clean up test repos
     needs: [init-build-upload, download-and-test]
     if: always()

.github/workflows/test_extra_commands.yaml

@@ -14,8 +14,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Build kernel
     runs-on: ubuntu-latest
     steps:

.github/workflows/update_abi_symbols.yaml

@@ -10,11 +10,13 @@ concurrency:
   group: ${{ github.workflow }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
+
+permissions: {}
 
 jobs:
   update:
+    permissions:
+      contents: read
     name: Refresh vendored ABI symbol files
     runs-on: ubuntu-latest
     steps:

.github/workflows/update_cache.yaml

@@ -8,8 +8,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     name: Update Nix builder cache (${{ matrix.arch }})
     strategy:
       matrix:

.github/workflows/vouch-check-pr.yaml

@@ -3,12 +3,14 @@ on:
   pull_request_target:
     types: [opened, reopened]
 
-permissions:
-  contents: read
-  pull-requests: write
+
+permissions: {}
 
 jobs:
   check:
+    permissions:
+      contents: read
+      pull-requests: write
     name: Check PR author
     runs-on: ubuntu-latest
     steps: