From 7e2ddd6f04fb8d7a163718e5e10529057fdfdb71 Mon Sep 17 00:00:00 2001
From: Chris Brown <chribrow@redhat.com>
Date: Wed, 22 Jul 2026 22:37:01 +0100
Subject: [PATCH] Harden repository security: least-privilege workflows and
 CODEOWNERS

Add explicit `permissions: contents: read` to all CI workflows so they
don't inherit the (now restricted) repo-wide default silently. Add a
CODEOWNERS file to enforce review routing through the maintainer.

Companion repo-level changes (already applied via API):
- Default workflow token permissions set to read-only
- Secret scanning and push protection enabled

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/CODEOWNERS                           | 3 +++
 .github/workflows/ci-action-io-generator.yml | 3 +++
 .github/workflows/ci-commit-data.yml         | 3 +++
 .github/workflows/verify-verifier.yml        | 3 +++
 4 files changed, 12 insertions(+)
 create mode 100644 .github/CODEOWNERS

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..6ef035a
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,3 @@
+* @snecklifter
+
+.github/ @snecklifter
diff --git a/.github/workflows/ci-action-io-generator.yml b/.github/workflows/ci-action-io-generator.yml
index 7dfcff9..5533211 100644
--- a/.github/workflows/ci-action-io-generator.yml
+++ b/.github/workflows/ci-action-io-generator.yml
@@ -11,6 +11,9 @@ on:
       - 'action-io-generator/**'
       - '.github/workflows/ci-action-io-generator.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/ci-commit-data.yml b/.github/workflows/ci-commit-data.yml
index 6eec8ad..4de23e3 100644
--- a/.github/workflows/ci-commit-data.yml
+++ b/.github/workflows/ci-commit-data.yml
@@ -10,6 +10,9 @@ on:
       - 'commit-data/**'
       - '.github/workflows/ci-commit-data.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/.github/workflows/verify-verifier.yml b/.github/workflows/verify-verifier.yml
index bffa6d9..3af3fd2 100644
--- a/.github/workflows/verify-verifier.yml
+++ b/.github/workflows/verify-verifier.yml
@@ -10,6 +10,9 @@ on:
       - 'bundle-verifier/**'
       - '.github/workflows/verify-verifier.yml'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true