Skip to content

Fix/token permissions id gitbot fleet 20260911 - #520

Closed
hyperpolymath wants to merge 3 commits into
mainfrom
fix/token-permissions-id-gitbot-fleet-20260911
Closed

Fix/token permissions id gitbot fleet 20260911#520
hyperpolymath wants to merge 3 commits into
mainfrom
fix/token-permissions-id-gitbot-fleet-20260911

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Sep 12, 2026

Copy link
Copy Markdown
Owner

Summary

Closes #

Type of change

  • 🐛 Bug fix (non-breaking change that fixes an issue)
  • ✨ New feature (non-breaking change that adds functionality)
  • 💥 Breaking change (would change existing behaviour)
  • 🕳️ Soundness fix (fixes a checker/proof false-negative)
  • 📖 Documentation
  • 🧹 Refactor / tech debt (behaviour-preserving)
  • ⚡ Performance
  • 🔧 Build / CI / tooling

How has this been verified?

Checklist

  • My commits are signed (git commit -S).
  • I ran the project's own checks/tests locally and they pass.
  • New files carry the correct SPDX-License-Identifier (code/config MPL-2.0,
    prose CC-BY-SA-4.0); I did not relicense existing files.
  • Docs are updated, and no public claim now overstates what the code does.
  • I have not introduced a soundness hole (or I have flagged where I might have).

Notes for reviewers

hyperpolymath and others added 3 commits September 11, 2026 10:48
@hyperpolymath @mistral-vibe
fix(ci): apply foundation CI/CD security fixes
7572e7d 
- Update CodeQL workflow to SHA-pinned actions with persist-credentials: false
- Update reusable workflow pins to current standards main SHAs

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
@hyperpolymath @mistral-vibe
Fix TokenPermissionsID: change top-level permissions to read, add job…
24aa9cd 
…-level write

Apply principle of least privilege for GITHUB_TOKEN:
- Change top-level permissions from 'contents: write, pull-requests: write' to read-only
- Add job-level permissions to auto-merge-prs and dispatch-to-hypatia jobs

This resolves Scorecard TokenPermissionsID alerts by following GitHub's
recommended security practice of granting minimal top-level permissions
and escalating only at the job level where needed.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
@mistral-vibe
Fix TokenPermissionsID: add contents: read to job permissions in scor…
eb1108e 
…ecard.yml

Fixes Scorecard TokenPermissionsID alert by adding explicit contents: read
permission to the analysis job's permissions block. When job-level permissions
are specified, GitHub sets unspecified permissions to 'none' by default.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>
@coderabbitai

coderabbitai Bot commented Sep 12, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a29d27dc-79a3-49f2-90f0-3e6cb12d749f

📥 Commits

Reviewing files that changed from the base of the PR and between 9e6abd2 and eb1108e.

📒 Files selected for processing (7)
  • .github/dependabot.yml
  • .github/workflows/codeql.yml
  • .github/workflows/governance.yml
  • .github/workflows/hypatia-scan.yml
  • .github/workflows/inbox-steward.yml
  • .github/workflows/scorecard.yml
  • robot-repo-automaton/.github/dependabot.yml

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath enabled auto-merge (squash) September 13, 2026 10:07
@hyperpolymath
hyperpolymath enabled auto-merge (squash) September 14, 2026 17:37
@hyperpolymath hyperpolymath mentioned this pull request Sep 17, 2026
Closed
13 tasks
@hyperpolymath

hyperpolymath commented Sep 17, 2026

Copy link
Copy Markdown
Owner Author

Closing: the pins this PR applies are dangling — merging would break the reusable-workflow calls it touches.

Evidence:

  • governance-reusable.yml@8f31a5a4ba591d544b65f91f6d78b136e07756f0 → HTTP 404 in hyperpolymath/standards
  • hypatia-scan-reusable.yml@cc58c0cb23f73fc2019ce85a56a468e5248a93b3 → HTTP 404
  • scorecard-reusable.yml@8750b94ac1bbe8c51ad13fe106669b13478f0b62 → HTTP 404
  • codeql-action pinned to cdf488f5… with a # v3 comment (that SHA is v4.37.9; main now runs v4.38.0)

main already carries valid, newer pins plus the lock regime, and the token/permissions intent is covered there. This is part of the same 2026-09-11 campaign batch as #516 (closed with the same finding).

auto-merge was automatically disabled September 17, 2026 10:14

Pull request was closed

@hyperpolymath
hyperpolymath deleted the fix/token-permissions-id-gitbot-fleet-20260911 branch September 18, 2026 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hyperpolymath @mistral-vibe