Description

14 workflows triggered by risky events (issue_comment, pull_request_target) use default (overly broad) permissions, violating the principle of least privilege. This increases the attack surface if workflows have vulnerabilities.

Affected Workflows:

• ai-moderator.md
• archie.md
• brave.md
• cloclo.md
• grumpy-reviewer.md
• mergefest.md
• pdf-summary.md
• plan.md
• pr-nitpick-reviewer.md
• q.md
• scout.md
• security-review.md
• tidy.md
• unbloat-docs.md

Suggested Changes

Add explicit minimal permissions to each workflow's YAML frontmatter:

For Issue/PR Comment Bots:

---
name: My Workflow
on:
  issue_comment:
    types: [created]
permissions:
  contents: read
  issues: write
  pull-requests: write
---

For PR Review Bots:

permissions:
  contents: read
  pull-requests: write

For Read-Only Analysis:

permissions:
  contents: read

Files Affected

All 14 workflow markdown files listed above (in .github/workflows/ or workflow directories)

Success Criteria

• All 14 workflows updated with explicit permissions
• Each workflow uses minimal required permissions
• Static analysis (zizmor) no longer flags these workflows
• All workflows still function correctly after changes
• No permission errors in workflow logs
• Workflows recompiled and lock files updated

Testing

For each updated workflow:

1. Recompile: make recompile
2. Trigger the workflow (manually or via event)
3. Verify it functions correctly
4. Check logs for permission errors
5. Adjust permissions if needed (prefer minimal)

Source

Extracted from Static Analysis Report - 2026-01-29

Key finding from report:

"Security Issues (Zizmor - 14 warnings) - Issue Type: default_permissions_on_risky_events. Workflows triggered by risky events use default (overly broad) permissions. Impact: Violates principle of least privilege, increases attack surface."

Historical improvement:

• Previous scan: 126 permission issues
• Current scan: 14 permission issues
• Progress: 89% reduction (but 14 remaining)

Priority

High - Security improvement with straightforward fix and significant benefit. Addresses findings from automated security scanning.

Estimated Effort

2-3 hours (review permissions for 14 workflows + test + recompile)

AI generated by Discussion Task Miner - Code Quality Improvement Agent

• expires on Feb 6, 2026, 9:08 PM UTC