From d289c0d4334fc6cb5331d3d2e9e16799e3429193 Mon Sep 17 00:00:00 2001
From: chopratejas <chopratejas@gmail.com>
Date: Sun, 3 May 2026 13:28:00 -0700
Subject: [PATCH] fix(ci): add minimal-privilege permissions blocks to
 release.yml jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Code-scanning alert #65 (CodeQL actions/missing-workflow-permissions,
CWE-275) flagged the new build-wheels job for not declaring an explicit
permissions block. While at it, audit the rest of release.yml — same
gap exists on detect-version, build, collect-dist, and publish-npm.

Each job gets `contents: read` (the minimal default) since none of them
push, write packages, or mutate releases through GITHUB_TOKEN. Existing
write-bearing jobs (publish-pypi: id-token, publish-github-packages:
packages, create-release: contents) keep their narrower scopes.
---
 .github/workflows/release.yml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 15b50589f..77152c4fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,6 +54,8 @@ concurrency:
 jobs:
   detect-version:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       version: ${{ steps.ver.outputs.version }}
       npm_version: ${{ steps.ver.outputs.npm_version }}
@@ -78,6 +80,8 @@ jobs:
   build:
     needs: [detect-version]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
@@ -164,6 +168,12 @@ jobs:
   # — one atomic install via `pip install headroom-ai`.
   build-wheels:
     needs: [detect-version, build]
+    # Minimal privilege: this job only checks out source, builds wheels,
+    # and uploads them as artifacts. It doesn't push, write packages, or
+    # mutate releases — `contents: read` is sufficient. Mitigates CodeQL
+    # alert "actions/missing-workflow-permissions" (CWE-275).
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -225,6 +235,8 @@ jobs:
   collect-dist:
     needs: [build, build-wheels]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Download all wheel artifacts
         uses: actions/download-artifact@v4
@@ -288,6 +300,10 @@ jobs:
     needs: [detect-version, build]
     if: github.event.inputs.dry_run != 'true' && vars.NPM_SKIP != 'true'
     runs-on: ubuntu-latest
+    # Publishes to npmjs.org via NPM_TOKEN secret; no GITHUB_TOKEN
+    # write permissions needed.
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with: