From 9283034175f73f07be92b732adaf96abe04c99f9 Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Wed, 23 Sep 2026 11:15:04 +0000
Subject: [PATCH] Scope GITHUB_TOKEN permissions per job

A job with no `permissions:` block inherits whatever the repository
hands out. Each block added here grants what that job's own steps
need and nothing more.
---
 .github/workflows/lockfile_registry_guard.yml | 6 ++++--
 .github/workflows/quality.yml                 | 6 ++++--
 .github/workflows/tests.yml                   | 6 ++++--
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/lockfile_registry_guard.yml b/.github/workflows/lockfile_registry_guard.yml
index eed515be2..6332715db 100644
--- a/.github/workflows/lockfile_registry_guard.yml
+++ b/.github/workflows/lockfile_registry_guard.yml
@@ -1,7 +1,5 @@
 name: Lockfile registry guard
 
-permissions:
-  contents: read
 
 # Fails fast if frontend/package-lock.json resolves packages from the internal
 # HF npm mirror (npm.registries.huggingface.tech). That mirror cannot serve the
@@ -21,8 +19,12 @@ on:
       - 'frontend/package-lock.json'
       - '.github/workflows/lockfile_registry_guard.yml'
 
+permissions: {}
+
 jobs:
   check:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7.0.1
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 37b38272a..778429700 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -14,8 +14,6 @@
 
 # This workflow handles linting, formatting, and static analysis checks for the codebase.
 name: Quality
-permissions:
-  contents: read
 
 on:
   workflow_dispatch:
@@ -31,8 +29,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pre-commit-checks:
+    permissions:
+      contents: read
     name: Run Pre-commit Hooks (Lint, Format & Static Analysis)
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9022788ce..212ac7922 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,8 +15,6 @@
 # This workflow runs the pytest suite on every PR and push to main.
 # Modeled on LeRobot's fast_tests.yml, collapsed to a single dependency tier.
 name: Tests
-permissions:
-  contents: read
 
 on:
   workflow_dispatch:
@@ -44,8 +42,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   pytest:
+    permissions:
+      contents: read
     name: Pytest
     runs-on: ubuntu-latest
     steps: