From ffc0a6cae298db252c37dbb74930ddbf17d9c03b Mon Sep 17 00:00:00 2001
From: Jason Naylor <jason_naylor@sil.org>
Date: Mon, 17 Aug 2026 14:15:17 -0700
Subject: [PATCH] Add least-privilege permissions to workflows missing them

Six workflows declared no permissions block and fell back to the
repository default GITHUB_TOKEN scope, which can be broader than the job
needs. Declare an explicit block on each so the token is scoped to the
work the job actually does.

The base installer gets contents: write to tag and publish its Release,
the commit-message check gets contents: read plus pull-requests: write
for its sticky comment, and link-check, openspec-validate,
check-whitespace, and stray-docs get contents: read only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/CommitMessage.yml     | 6 ++++++
 .github/workflows/base-installer-cd.yml | 5 +++++
 .github/workflows/check-whitespace.yml  | 3 +++
 .github/workflows/link-check.yml        | 3 +++
 .github/workflows/openspec-validate.yml | 3 +++
 .github/workflows/stray-docs.yml        | 3 +++
 6 files changed, 23 insertions(+)

diff --git a/.github/workflows/CommitMessage.yml b/.github/workflows/CommitMessage.yml
index 8e8deb891f..b724716c62 100644
--- a/.github/workflows/CommitMessage.yml
+++ b/.github/workflows/CommitMessage.yml
@@ -3,6 +3,12 @@ on:
   pull_request:
   workflow_call:
 
+permissions:
+  contents: read
+  # pull-requests: write lets the sticky-comment step post and clear the
+  # commit-message feedback comment on the PR.
+  pull-requests: write
+
 jobs:
   gitlint:
     name: Check commit messages
diff --git a/.github/workflows/base-installer-cd.yml b/.github/workflows/base-installer-cd.yml
index 99f88e46bd..f417b68a15 100644
--- a/.github/workflows/base-installer-cd.yml
+++ b/.github/workflows/base-installer-cd.yml
@@ -43,6 +43,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  # contents: write is required to tag the repo and publish the GitHub Release
+  # (softprops/action-gh-release); no other GITHUB_TOKEN write is needed here.
+  contents: write
+
 jobs:
   debug_build_and_test:
     env:
diff --git a/.github/workflows/check-whitespace.yml b/.github/workflows/check-whitespace.yml
index dc0e169b66..f68f7bc3cb 100644
--- a/.github/workflows/check-whitespace.yml
+++ b/.github/workflows/check-whitespace.yml
@@ -9,6 +9,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     check-whitespace:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/link-check.yml b/.github/workflows/link-check.yml
index 24fe0db73f..732544d9c7 100644
--- a/.github/workflows/link-check.yml
+++ b/.github/workflows/link-check.yml
@@ -4,6 +4,9 @@ on:
     pull_request:
     workflow_dispatch:
 
+permissions:
+    contents: read
+
 jobs:
     lychee:
         runs-on: ubuntu-latest
diff --git a/.github/workflows/openspec-validate.yml b/.github/workflows/openspec-validate.yml
index 3fb92fb38e..8b777f1bf2 100644
--- a/.github/workflows/openspec-validate.yml
+++ b/.github/workflows/openspec-validate.yml
@@ -6,6 +6,9 @@ on:
       - 'openspec/**'
       - '**/AGENTS.md'
 
+permissions:
+  contents: read
+
 jobs:
   validate-refs:
     runs-on: windows-2022
diff --git a/.github/workflows/stray-docs.yml b/.github/workflows/stray-docs.yml
index f7fdce040c..e190573aaa 100644
--- a/.github/workflows/stray-docs.yml
+++ b/.github/workflows/stray-docs.yml
@@ -8,6 +8,9 @@ concurrency:
     group: ${{ github.workflow }}-${{ github.ref }}
     cancel-in-progress: true
 
+permissions:
+    contents: read
+
 jobs:
     stray-docs:
         runs-on: ubuntu-latest