fix(ci): validate effective workflow contents permissions

[seonghobae]

Repair finding

Successor security-policy repair stacked on formatter prerequisite #1176. The consolidated supply-chain test on protected develop checks raw workflow text for contents: read / permissions: read-all. A comment or unrelated string can therefore satisfy that assertion even when effective workflow or job permissions grant contents: write.

This lane does not take ownership of #1176's formatter delta. Base is #1176 exact 8fe6b6d99c009527ef0bcba419e6f6debdb23c23; exact current head is 2f121f14d64fa0cb343e96e24fbd6ca522203db6. The PR is Open / Draft / mergeable and owns only semantic GitHub Actions permission validation.

RED → causal repair

RED d939aa6f6e29cc69afc212b0907664a0ae0d1937 adds behavioral regressions requiring:

• the real ossf-scorecard.yml, release.yml, and security-audit.yml backstops to keep repository contents read-only;
• # contents: read not to hide effective workflow contents: write;
• job-level contents: write not to override a read-only workflow token;
• missing explicit workflow permissions to fail closed rather than inherit mutable repository defaults.

The RED intentionally referenced the absent semantic verifier and was immediately followed by repair before any hosted terminal verdict, so no hosted RED is claimed.

Repair 2f121f14d64fa0cb343e96e24fbd6ca522203db6 adds scripts/checks/workflow_permissions.py. It parses workflow YAML with the repository-pinned PyYAML dependency, requires explicit workflow-level read-only contents authority (read-all or contents: read), and rejects workflow/job write-all or contents: write. Job-level maps may omit contents, which GitHub interprets as no permission for unspecified scopes when job permissions are declared.

Trust boundary

GitHub Actions workflow YAML is executable supply-chain policy. This check reasons over parsed permission values rather than comments/substrings. It does not weaken required checks, change runtime workflow permissions, add network/filesystem authority, or copy a central .github control.

Exact-head evidence / stack gate

Exact 2f121f14... currently has zero hosted PR workflow generations by design of the existing workflow admission rules: repository CI/security workflows declare pull_request.branches: [develop, main], while this repair is intentionally stacked on #1176's feature branch to avoid claiming ownership of its formatter delta. Zero runs therefore are not GREEN.

Keep Draft. #1176 must integrate normally first; this lane then retargets/reconciles to protected develop without force-push and obtains fresh exact-head CI, security/SAST, SBOM/supply-chain, CodeQL/central evidence plus qualifying independent non-author approval. No self-approval, gate weakening, synthetic status, blind rerun, or source-neutral wake commit.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}