From 671173b49897255195ad62a425160b2b9e30752a Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Thu, 23 Jul 2026 13:03:40 +0500
Subject: [PATCH] ci: harden GitHub workflow permissions to least privilege
 (#27414)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Hardens GitHub Actions workflow token permissions to address OpenSSF
Scorecard findings.

## Changes

- Default affected workflows to no token permissions (`permissions:
{}`).
- Move required write permissions directly to the jobs that consume
them.
- Document the least-privilege permissions rule in `AGENTS.md`: never
grant write permissions at the workflow top level; scope grants to
`jobs.<id>.permissions`.

## Validation

- `make lint-light` passed locally via pre-commit hooks.

> 🤖 This PR was created with the help of Coder Agents, and needs a human
review. 🧑💻
---
 .github/workflows/cherry-pick.yaml          | 11 ++++++-----
 .github/workflows/pr-auto-assign.yaml       |  5 +++--
 .github/workflows/pr-cherry-pick-check.yaml |  5 +++--
 .github/workflows/publish-mcp-registry.yaml |  2 ++
 AGENTS.md                                   |  5 +++++
 5 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/cherry-pick.yaml b/.github/workflows/cherry-pick.yaml
index 8654f9ca76..bfdc601538 100644
--- a/.github/workflows/cherry-pick.yaml
+++ b/.github/workflows/cherry-pick.yaml
@@ -22,11 +22,7 @@ on:
       - closed
       - labeled
 
-permissions:
-  contents: write
-  pull-requests: write
-  # Required to create the release-specific cherry-pick label if missing.
-  issues: write
+permissions: {}
 
 # Prevent duplicate runs for the same PR when both 'closed' and 'labeled'
 # fire in quick succession.
@@ -36,6 +32,11 @@ concurrency:
 jobs:
   cherry-pick:
     name: Cherry-pick to latest release
+    permissions:
+      contents: write
+      pull-requests: write
+      # Required to create the release-specific cherry-pick label if missing.
+      issues: write
     if: >
       github.event.pull_request.merged == true &&
       contains(github.event.pull_request.labels.*.name, 'cherry-pick')
diff --git a/.github/workflows/pr-auto-assign.yaml b/.github/workflows/pr-auto-assign.yaml
index bdb7730d74..a910bc9600 100644
--- a/.github/workflows/pr-auto-assign.yaml
+++ b/.github/workflows/pr-auto-assign.yaml
@@ -7,11 +7,12 @@ on:
   pull_request_target:
     types: [opened]
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   assign-author:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/pr-cherry-pick-check.yaml b/.github/workflows/pr-cherry-pick-check.yaml
index db3a099aeb..dedc730d8a 100644
--- a/.github/workflows/pr-cherry-pick-check.yaml
+++ b/.github/workflows/pr-cherry-pick-check.yaml
@@ -9,11 +9,12 @@ on:
     branches:
       - "release/*"
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   check-cherry-pick:
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/publish-mcp-registry.yaml b/.github/workflows/publish-mcp-registry.yaml
index ce203433ee..f88f9e51a0 100644
--- a/.github/workflows/publish-mcp-registry.yaml
+++ b/.github/workflows/publish-mcp-registry.yaml
@@ -15,6 +15,8 @@ on:
         default: false
         type: boolean
 
+permissions: {}
+
 jobs:
   publish-mcp:
     runs-on: ubuntu-latest
diff --git a/AGENTS.md b/AGENTS.md
index bf1ddbb7e7..4cd36c1e84 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -104,6 +104,11 @@ instructions focused on guardrails that agents should see immediately.
 - **Frontend**: Read [Frontend Development Guidelines](site/AGENTS.md)
   before changing anything under `site/`. Reuse shared UI primitives when
   possible and prefer Storybook stories for component and page testing.
+- **GitHub Actions permissions**: Follow least privilege as recommended by
+  OpenSSF Scorecard. Do not set write permissions at the workflow
+  (top) level. Default every workflow to `permissions: {}` at the top level
+  and grant only the specific permissions each job needs under
+  `jobs.<id>.permissions`.
 
 ## Quick Reference