Security: Add `permissions:` blocks to all GitHub Actions workflows to restrict GITHUB_TOKEN scope

[LucasMaupin]

Summary

None of the GitHub Actions workflow files in Eyevinn/intercom-frontend declare an explicit permissions: block at the workflow or job level. Every workflow run therefore receives the GitHub-default GITHUB_TOKEN permissions, which include write access to contents, pull-requests, packages, and more — far broader than most jobs need.

The workflow_dispatch workflow (run-dispatch.yml) is the highest-risk: it only needs to trigger a repository dispatch event but implicitly holds write access to the entire repository.

Affected Files

• .github/workflows/run-dispatch.yml
• .github/workflows/run-lint.yml
• .github/workflows/run-prettier.yml
• .github/workflows/run-typescript.yml
• .github/workflows/run-unittests.yml
• .github/workflows/run-e2e.yml
• .github/workflows/run-publish.yml
• .github/workflows/release-notes.yml

Risk

If any workflow step is compromised (e.g., via a malicious action or a script injection attack), the overly-permissive GITHUB_TOKEN can be used to push code, approve pull requests, modify releases, or read/exfiltrate secrets.

Recommended Fix

Add a top-level permissions: read-all default (or contents: read) to every workflow, then grant only the minimum required permissions at the job level.

Minimal read-only baseline (add to all CI workflows — lint, prettier, typescript, unittests, e2e):

permissions:
  contents: read

run-publish.yml (pushes to Docker Hub — GITHUB_TOKEN is not used for writes):

permissions:
  contents: read

release-notes.yml (creates a GitHub release):

permissions:
  contents: write

run-dispatch.yml (repository dispatch only — REPO_DISPATCH_TOKEN is a PAT, GITHUB_TOKEN unused):

permissions:
  contents: read

References

• GitHub Docs: Permissions for the GITHUB_TOKEN
• StepSecurity: Restrict permissions
• Related: Security: Pin GitHub Actions workflow steps to full commit SHAs to prevent supply chain attacks #657 (SHA pinning), Security: Use npm ci instead of npm install in release-notes.yml to enforce lockfile integrity #658 (npm ci)

[birme]

Picked up by daily-backlog-pr but cannot be auto-implemented this run: the fix requires editing files under .github/workflows/, and the automation's GitHub token lacks the workflow OAuth scope needed to push workflow changes (GitHub rejects such pushes with refusing to allow ... without workflow scope).

Leaving this in Ready. It needs either a maintainer with a workflow-scoped token/PAT, or a token upgrade for the automation. No code change was made.