[hf-security-analysis]

Automated hardening of the workflow files flagged on #115.

Warning

This narrows what the workflow can reach. Job permissions were declared in .github/workflows/release.yml, .github/workflows/test.yml. Each job now gets only the scopes its steps were read to need — if one of them does something this could not see, it will fail on the next run. The table below says which step drove each scope.

Targets dependabot/github_actions/actions-51b6da08d1. Files changed:

• .github/workflows/release.yml
• .github/workflows/test.yml

Fixed by this PR:

• MEDIUM excessive-permissions (zizmor) — .github/workflows/release.yml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/release.yml:19
• MEDIUM excessive-permissions (zizmor) — .github/workflows/release.yml:88
• MEDIUM excessive-permissions (zizmor) — .github/workflows/release.yml:118
• MEDIUM excessive-permissions (zizmor) — .github/workflows/test.yml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/test.yml:13
• MEDIUM excessive-permissions (zizmor) — .github/workflows/test.yml:102

This does not fix everything. 1 further finding(s) (1 critical) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/release.yml

job	granted	why
dist	contents: read	Only checks out the repo (actions/checkout) and builds with cargo; actions/upload-artifact within the same run needs no token scope.
dist-x86_64-unknown-linux-musl	contents: read	Same as the other dist job: actions/checkout drives contents: read, and upload-artifact in the same run needs nothing.
publish	contents: write	The final 'Publish Release' step uses the local ./.github/actions/github-release action with files/name/token inputs to create a GitHub release, which requires contents: write; that action's source is not in this file, so a reviewer should confirm it only touches releases, while the download-artifact steps pull artifacts from the same run and need no scope.

.github/workflows/test.yml

job	granted	why
testbed	contents: read	actions/checkout needs contents: read; the cargo build/run and upload-artifact steps in the same run need no token scopes (the testbed binary uses a separate API_TOKEN secret, not GITHUB_TOKEN).
comment_results	pull-requests: write	peter-evans/find-comment and create-or-update-comment post/update a comment on the pull request, requiring pull-requests: write; download-artifact steps target the same run so need nothing extra.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.