From dd951a4910d4a178e6bf509c746cb78882c74034 Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Mon, 17 Aug 2026 12:10:55 -0700
Subject: [PATCH] Add explicit GITHUB_TOKEN permissions to CI and audit
 workflows

Resolves the eight open `actions/missing-workflow-permissions` CodeQL
alerts (#1, #3, #4, #5, #6, #7, #8, #9). Every job now has an effective
`permissions:` block scoped to what it actually does.

ci.yml
  Workflow-level `contents: read` covers `check`, `test` and `lints`,
  which only check out the repo and run cargo check/test/fmt/clippy.

  Four jobs override to `contents: write` because they mutate releases:
  - `release` runs `gh release create --generate-notes`
  - `upload-mac-universal-bin` and `upload-linux-bin` run
    `gh release upload` to attach the built tarballs
  - `generate-dotslash-files` uses facebook/dotslash-publish-release,
    which also publishes via `gh release upload`

audit.yml
  `rustsec/audit-check` needs `checks: write` to publish the advisory
  status check on push/pull_request runs and `issues: write` to open an
  issue per new advisory on the weekly scheduled run (both documented in
  the action's README). `contents: read` covers actions/checkout. It
  does not upload SARIF, so no `security-events: write`.

codeql.yml already declares permissions and is untouched.
---
 .github/workflows/audit.yml |  6 ++++++
 .github/workflows/ci.yml    | 11 +++++++++++
 2 files changed, 17 insertions(+)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 9945216..f937aaa 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -12,6 +12,12 @@ on:
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      # rustsec/audit-check reports advisories as a check run on push/PR and
+      # opens issues on the scheduled run.
+      checks: write
+      contents: read
+      issues: write
     # cargo-audit's dependency tree can require a newer rustc than this repo's
     # pinned rust-toolchain.toml (used to build the actual crate). Override
     # with the runner's default stable toolchain just for this job so
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e50da77..355b537 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,6 +17,9 @@ on:
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  contents: read
+
 jobs:
   check:
     name: Check
@@ -55,6 +58,8 @@ jobs:
 
   release:
     runs-on: macos-latest
+    permissions:
+      contents: write
     needs:
       - test
       - lints
@@ -101,6 +106,8 @@ jobs:
   upload-mac-universal-bin:
     needs: release
     runs-on: macos-latest
+    permissions:
+      contents: write
     if: ${{needs.release.outputs.new_version}}
     steps:
       - uses: actions/checkout@v4
@@ -126,6 +133,8 @@ jobs:
     needs: release
     if: ${{needs.release.outputs.new_version}}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v4
       - name: Update local toolchain
@@ -153,6 +162,8 @@ jobs:
       - upload-mac-universal-bin
     if: success() && ${{needs.release.outputs.new_version}}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - uses: facebook/dotslash-publish-release@v1