From 67c0f87931b6e71780a347f919943e40c66e460c Mon Sep 17 00:00:00 2001
From: Daniel Bersenkowitsch <accounts@projectbay.io>
Date: Fri, 10 Jul 2026 13:55:04 +0200
Subject: [PATCH] chore(ci): add least-privilege top-level permissions to the
 release/codeql workflows

codeql.yml, release-nestjs.yml, and release-docker.yml had no top-level
`permissions:` block (OpenSSF Scorecard TokenPermissions, high). Add a
restrictive `contents: read` default; each job already declares the elevated
permissions it needs (packages:write / contents:write / id-token:write /
security-events:write), which override the default. No behavior change; quiets
the recurring code-scanning noise so a real alert can't hide behind it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/codeql.yml         | 4 ++++
 .github/workflows/release-docker.yml | 4 ++++
 .github/workflows/release-nestjs.yml | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 2a4eb16..f313e86 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: "27 3 * * 1" # Mondays 03:27 UTC
 
+# Least-privilege default; the analyze job elevates to what CodeQL needs.
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
diff --git a/.github/workflows/release-docker.yml b/.github/workflows/release-docker.yml
index 923c116..869e142 100644
--- a/.github/workflows/release-docker.yml
+++ b/.github/workflows/release-docker.yml
@@ -28,6 +28,10 @@ on:
     tags: ['v*']
   workflow_dispatch:
 
+# Least-privilege default; the publish job elevates (contents:read, packages:write).
+permissions:
+  contents: read
+
 concurrency:
   group: release-docker-${{ github.ref }}
   cancel-in-progress: false
diff --git a/.github/workflows/release-nestjs.yml b/.github/workflows/release-nestjs.yml
index cf93a97..43b63ee 100644
--- a/.github/workflows/release-nestjs.yml
+++ b/.github/workflows/release-nestjs.yml
@@ -26,6 +26,10 @@ on:
     tags: ['v*', 'nestjs-v*']
   workflow_dispatch:
 
+# Least-privilege default; the publish job elevates (contents:write, id-token:write).
+permissions:
+  contents: read
+
 concurrency:
   group: release-nestjs-${{ github.ref }}
   cancel-in-progress: false