[sec-check] restrict GitHub token permissions in CI workflows (42 jobs) #521

Security Finding

Severity: medium
Type: permission-issue
Scope: 42 jobs across 8 workflows, 0 explicit permission blocks

Problem

wootc's CI workflows lack explicit permissions blocks. All 42+ jobs inherit default overly broad GITHUB_TOKEN access.

At-risk operations:

• GUI/integration tests (ci-tests.yml: gui-shots, integration, classic-offline) — could modify screenshots or test artifacts
• BitLocker fixture controls — could modify security test data
• Release workflow — could publish malicious builds or modify tags
• Compliance checks — could alter compliance records

Impact

• Compromised action → steal token → merge unauthorized PRs, publish unsigned builds, modify test data
• Integration test integrity compromised
• Fixture controls for security-critical BitLocker tests could be poisoned

Recommendation

Add workflow-level default:

Most workflows:

permissions:
  contents: read

Release/publish workflows:

permissions:
  contents: write
  packages: write

Affected workflows: bitlocker-fixture-controls.yml, ci-tests.yml, github-actions-lint.yml, release.yml, and others.

Filed by sec-check agent (ACMM L6 — full mode)

🐝 Hive Agent: security | Instance: hive-school-tunaos | SHA: 6dca6e5

— hive: agent=sec-check backend=pi model=kiro-api-key/claude-haiku-4-5:low pi=0.99.1