ci: 🔒 Scope token on GH workflows

[evaline-ju]

Summary

Scope token permissions for Github workflows - write scopes mostly moved down to individual jobs

Summary by CodeRabbit

• Chores
  • Updated automation workflows with more narrowly scoped access permissions.
  • Build and package publishing workflows continue to support required publishing actions.
  • Dependency maintenance, issue self-assignment, spell checking, and stale-item management workflows remain supported.
  • Workflow access settings are now explicitly defined for repository contents, issues, pull requests, and package publishing tasks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0eef6301-29a3-42bf-955f-06a1e40c65e3

📥 Commits

Reviewing files that changed from the base of the PR and between c93c3f4 and 36ecfb3.

📒 Files selected for processing (5)

• .github/workflows/build.yaml
• .github/workflows/dependabot-tidy.yml
• .github/workflows/self-assign.yml
• .github/workflows/spellcheck_action.yml
• .github/workflows/stale.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflows now use contents: read as the default permission. Jobs that require write access declare packages, contents, issues, or pull-requests permissions locally.

Changes

Workflow permission scoping

Layer / File(s)	Summary
Workflow-level read defaults .github/workflows/dependabot-tidy.yml, .github/workflows/spellcheck_action.yml	Workflow-level permissions now restrict repository contents to read access.
Job-scoped write permissions .github/workflows/build.yaml, .github/workflows/dependabot-tidy.yml, .github/workflows/self-assign.yml, .github/workflows/stale.yaml	Jobs declare the write permissions required for package publishing, Dependabot updates, issue assignment, and stale-item management.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 36ecf

The workflow permission changes present no actionable merge-blocking risk; the PR is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: scoping GitHub Actions token permissions to individual jobs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (5 skipped: 5 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[clawgenti]

This PR correctly applies the principle of least privilege across five GitHub Actions workflows by demoting broad top-level write permissions to the individual jobs that actually require them, while defaulting workflows to contents: read at the top level.

All checks pass. Ready for human review.

---

Reviewed by clawgenti using the github-pr-review skill

[esnible]

Least-privilege token scoping across five workflows: top-level permissions drops to contents: read, write scopes move down to the single job that needs them, each with an inline comment explaining why. Also adds the missing top-level permissions block to spellcheck_action.yml.

Areas reviewed: CI/GitHub Actions (YAML)
Agent/IDE config (.claude/.vscode): none
Commits: 1, signed-off: yes
CI status: passing (Spellcheck skipped by design — if: false)

What I verified

• Reusable-workflow calls are correct. self-assign.yml and stale.yaml call org-wide reusables. jobs.<id>.permissions is valid on a uses: job, and the caller's grant is the ceiling — the callee can only downgrade. rossoctl/.github's stale.yaml declares no job-level permissions, so it inherits the caller's new issues: write + pull-requests: write. self-assign-reusable.yml declares contents: read + issues: write on both its jobs, matching the caller's grant exactly. Neither call loses a needed scope.
• No sibling jobs starved. Each of the five workflows has exactly one job, so moving scopes down cannot strip permissions from another job in the same file.
• dependabot-tidy.yml retains what it needs. The job does git push (contents: write) and gh pr close/reopen via secrets.GITHUB_TOKEN (pull-requests: write). Both granted at job level.
• build.yaml keeps packages: write on the job that pushes to ghcr.io.
• Repo-wide consistency. spellcheck_action.yml was the only workflow in the repo lacking a top-level permissions: block; this closes that gap. The pattern matches the existing precedent in the untouched project.yml and release-binaries.yaml.

No blocking issues, no suggestions, no nits. Strictly a security improvement with no behavioral regression I could find.

Assisted-By: Claude Code