From 3191e38ac33b6af70d59de0b3b41f525781390b1 Mon Sep 17 00:00:00 2001
From: Shubham Pampattiwar <spampatt@redhat.com>
Date: Wed, 2 Sep 2026 11:47:14 -0700
Subject: [PATCH] Set least-privilege GITHUB_TOKEN permissions in workflows

Add an explicit top-level permissions block to the GitHub Actions
workflows that were relying on the default token permissions. Each
workflow now defaults to contents: read, with additional scopes granted
only where a job needs them:

* nightly-trivy-scan keeps security-events: write at the job level to
  upload SARIF results, plus contents: read for checkout.
* stale-issues gets issues: write and pull-requests: write for the
  actions/stale action to label and close stale items.

Setting least-privilege permissions reduces the blast radius if a
workflow or one of its dependencies is compromised, and satisfies the
CLOMonitor token_permissions check.

Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
---
 .github/workflows/get-go-version.yaml    | 3 +++
 .github/workflows/nightly-trivy-scan.yml | 4 ++++
 .github/workflows/pr-ci-check.yml        | 4 ++++
 .github/workflows/pr-codespell.yml       | 4 ++++
 .github/workflows/pr-containers.yml      | 3 +++
 .github/workflows/pr-filepath-check.yml  | 4 ++++
 .github/workflows/pr-goreleaser.yml      | 3 +++
 .github/workflows/pr-linter-check.yml    | 4 ++++
 .github/workflows/push-builder.yml       | 3 +++
 .github/workflows/stale-issues.yml       | 5 +++++
 10 files changed, 37 insertions(+)

diff --git a/.github/workflows/get-go-version.yaml b/.github/workflows/get-go-version.yaml
index fa4fb5e00..d77ed0af1 100644
--- a/.github/workflows/get-go-version.yaml
+++ b/.github/workflows/get-go-version.yaml
@@ -10,6 +10,9 @@ on:
         description: "The expected Go version"
         value: ${{ jobs.extract.outputs.version }}
 
+permissions:
+  contents: read
+
 jobs:
   extract:
       runs-on: ubuntu-latest
diff --git a/.github/workflows/nightly-trivy-scan.yml b/.github/workflows/nightly-trivy-scan.yml
index 09dcdbf4f..0999b1c0f 100644
--- a/.github/workflows/nightly-trivy-scan.yml
+++ b/.github/workflows/nightly-trivy-scan.yml
@@ -3,6 +3,9 @@ on:
   schedule:
     - cron: '0 2 * * *' # run at 2 AM UTC
 
+permissions:
+  contents: read
+
 jobs:
   nightly-scan:
     name: Trivy nightly scan
@@ -15,6 +18,7 @@ jobs:
         # list of images that need scan
         images: [velero, velero-plugin-for-aws, velero-plugin-for-gcp, velero-plugin-for-microsoft-azure]
     permissions:
+      contents: read  # for actions/checkout to fetch code
       security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
 
     steps:
diff --git a/.github/workflows/pr-ci-check.yml b/.github/workflows/pr-ci-check.yml
index fd5948f7b..8f431af63 100644
--- a/.github/workflows/pr-ci-check.yml
+++ b/.github/workflows/pr-ci-check.yml
@@ -1,5 +1,9 @@
 name: Pull Request CI Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   get-go-version:
     uses: ./.github/workflows/get-go-version.yaml
diff --git a/.github/workflows/pr-codespell.yml b/.github/workflows/pr-codespell.yml
index 97cdb48d4..bd12201ca 100644
--- a/.github/workflows/pr-codespell.yml
+++ b/.github/workflows/pr-codespell.yml
@@ -1,5 +1,9 @@
 name: Pull Request Codespell Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
 
   codespell:
diff --git a/.github/workflows/pr-containers.yml b/.github/workflows/pr-containers.yml
index b615d2b8e..555a68aa1 100644
--- a/.github/workflows/pr-containers.yml
+++ b/.github/workflows/pr-containers.yml
@@ -9,6 +9,9 @@ on:
       - 'Dockerfile'
       - 'Dockerfile-Windows'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/pr-filepath-check.yml b/.github/workflows/pr-filepath-check.yml
index 5ec2cb03b..45954873a 100644
--- a/.github/workflows/pr-filepath-check.yml
+++ b/.github/workflows/pr-filepath-check.yml
@@ -1,5 +1,9 @@
 name: Pull Request File Path Check
 on: [pull_request]
+
+permissions:
+  contents: read
+
 jobs:
 
   filepath-check:
diff --git a/.github/workflows/pr-goreleaser.yml b/.github/workflows/pr-goreleaser.yml
index 0cbec3329..b93d0626c 100644
--- a/.github/workflows/pr-goreleaser.yml
+++ b/.github/workflows/pr-goreleaser.yml
@@ -9,6 +9,9 @@ on:
       - '.goreleaser.yml'
       - 'hack/release-tools/goreleaser.sh'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/pr-linter-check.yml b/.github/workflows/pr-linter-check.yml
index 1a25569f1..57058757f 100644
--- a/.github/workflows/pr-linter-check.yml
+++ b/.github/workflows/pr-linter-check.yml
@@ -6,6 +6,10 @@ on:
       - "site/**"
       - "design/**"
       - "**/*.md"
+
+permissions:
+  contents: read
+
 jobs:
   get-go-version:
     uses: ./.github/workflows/get-go-version.yaml
diff --git a/.github/workflows/push-builder.yml b/.github/workflows/push-builder.yml
index 164d9104a..7dd0a9ab4 100644
--- a/.github/workflows/push-builder.yml
+++ b/.github/workflows/push-builder.yml
@@ -6,6 +6,9 @@ on:
     paths:
     - 'hack/build-image/Dockerfile'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml
index b66a339c8..16ef764b7 100644
--- a/.github/workflows/stale-issues.yml
+++ b/.github/workflows/stale-issues.yml
@@ -3,6 +3,11 @@ on:
   schedule:
     - cron: "30 1 * * *" # Every day at 1:30 UTC
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     if: github.repository == 'velero-io/velero'