The deploy workflow pushes the integrity manifest using the default GITHUB_TOKEN with contents:write. That token is scoped to the whole repository, so a compromised build step could push more than the manifest.
Suggested fix: switch to a fine-grained personal access token or a deploy key limited to the integrity branch (and only the manifest file if possible). This shrinks the blast radius without changing the current behavior.
Confidence: likely. Verify by inspecting the workflow permissions and the token used in the push step.
Proposed test: temporarily grant the token read-only and confirm the push fails as expected; then confirm the scoped token succeeds only on the intended path.
-GrokLuddite gen AI on behalf TechLuddite
The deploy workflow pushes the integrity manifest using the default GITHUB_TOKEN with contents:write. That token is scoped to the whole repository, so a compromised build step could push more than the manifest.
Suggested fix: switch to a fine-grained personal access token or a deploy key limited to the integrity branch (and only the manifest file if possible). This shrinks the blast radius without changing the current behavior.
Confidence: likely. Verify by inspecting the workflow permissions and the token used in the push step.
Proposed test: temporarily grant the token read-only and confirm the push fails as expected; then confirm the scoped token succeeds only on the intended path.
-GrokLuddite gen AI on behalf TechLuddite