Security: Add `permissions:` blocks to all GitHub Actions workflows to restrict GITHUB_TOKEN scope

[LucasMaupin]

Summary

None of the GitHub Actions workflow files in Eyevinn/intercom-manager declare an explicit permissions: block at the workflow or job level. Every workflow run therefore receives the GitHub-default GITHUB_TOKEN permissions, which include write access to contents, pull-requests, packages, and more — far broader than most jobs need.

The workflow_dispatch workflow (dispatch.yml) is the highest-risk: it only needs to trigger a repository dispatch event but implicitly holds write access to the entire repository.

Affected Files

• .github/workflows/dispatch.yml
• .github/workflows/lint.yml
• .github/workflows/pretty.yml
• .github/workflows/typescript.yml
• .github/workflows/unittests.yml
• .github/workflows/publish.yml
• .github/workflows/development.yml
• .github/workflows/release-notes.yml

Risk

If any workflow step is compromised (e.g., via a malicious action or a script injection attack), the overly-permissive GITHUB_TOKEN can be used to push code, approve pull requests, modify releases, or read/exfiltrate secrets. This is documented in GitHub's supply-chain security guidance.

Recommended Fix

Add a top-level permissions: read-all default (or contents: read) to every workflow, then grant only the minimum required permissions at the job level.

Minimal read-only baseline (add to all CI workflows — lint, pretty, typescript, unittests):

permissions:
  contents: read

publish.yml (pushes to Docker Hub — GITHUB_TOKEN not used for writes):

permissions:
  contents: read

release-notes.yml (creates a GitHub release):

permissions:
  contents: write

dispatch.yml (repository dispatch only — REPO_DISPATCH_TOKEN is a PAT, GITHUB_TOKEN unused):

permissions:
  contents: read

References

• GitHub Docs: Permissions for the GITHUB_TOKEN
• StepSecurity: Restrict permissions
• Related: Security: Pin GitHub Actions to commit SHAs to prevent supply chain attacks #235 (SHA pinning), Security: Replace long-lived AWS IAM static credentials in CI with OIDC-based short-lived tokens #266 (OIDC for AWS credentials)

[birme]

Picked up by daily-backlog-pr but cannot be auto-implemented this run: the fix requires editing files under .github/workflows/, and the automation's GitHub token lacks the workflow OAuth scope needed to push workflow changes (GitHub rejects such pushes with refusing to allow ... without workflow scope).

Leaving this in Ready. It needs either a maintainer with a workflow-scoped token/PAT, or a token upgrade for the automation. No code change was made.

[birme]

Attempted by today's daily-backlog-pr run but blocked: this issue is entirely edits to files under .github/workflows/. The automation's GitHub token has repo + project scope but not workflow scope, and GitHub rejects any create/update of workflow files (at both the push and the low-level git-tree API level) without it. No PR could be opened.

A maintainer with workflow-scoped credentials needs to add the permissions: blocks directly, or the automation's token needs the workflow scope added. Moving back to Ready.