chore(security): add top-level permissions to 5 reusable workflows

[anandray]

Summary

Adds permissions: contents: read (least-privilege default) to the top of five workflow files that had no top-level permissions declaration. Closes 5 Scorecard TokenPermissionsID alerts.

Files changed

File	Closes Scorecard alert	Existing job-level permissions preserved
.github/workflows/_build.yaml	#513	Yes (Docker push job retains packages: write)
.github/workflows/_docker.yaml	#514	Yes
.github/workflows/_init.yaml	#515	Yes (no job-level changes needed)
.github/workflows/_release.yaml	#516	Yes (release jobs retain contents: write, packages: write)
.github/workflows/sync-models.yml	#605	Yes (sync job retains contents: write, pull-requests: write)

Why this is safe

• All five are reusable workflows invoked via uses: ./.github/workflows/_*.yaml from caller workflows, except sync-models.yml which runs on schedule
• Top-level permissions: acts as a default ceiling, not a hard cap — individual jobs raise to write where they need it
• Existing job-level permissions: blocks are unchanged
• contents: read matches the pattern in secret-scan.yml and ci.yml

Type

chore (security hardening)

Linked Issue

Fixes #789

Out of scope (follow-up PRs)

• Stage 2 — narrow broad top-level writes in nightly.yaml + storage-cleanup.yml (3 alerts)
• Stage 3 — justify or selectively dismiss the 7 job-level write alerts on legitimate release/build operations

SOC2 Notes

CC7.1 vulnerability management — mechanical batch resolution of 5 critical/high TokenPermissionsID findings within the SLA window. SECURITY.md disposition: Fixed.

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow permissions across build, deployment, and sync pipelines to enforce least-privilege access controls at the workflow level.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 37433fc1-4764-459e-85e4-4a70c8b071a5

📥 Commits

Reviewing files that changed from the base of the PR and between 9846a14 and 6d9c58f.

📒 Files selected for processing (5)

• .github/workflows/_build.yaml
• .github/workflows/_docker.yaml
• .github/workflows/_init.yaml
• .github/workflows/_release.yaml
• .github/workflows/sync-models.yml

---

📝 Walkthrough

Walkthrough

Five reusable GitHub Actions workflows (_build.yaml, _docker.yaml, _init.yaml, _release.yaml, sync-models.yml) now declare top-level least-privilege permissions (contents: read). Job-level permissions remain unchanged. No other workflow logic or job definitions were modified.

Changes

SOC2 Compliance: Workflow Permission Declarations

Layer / File(s)	Summary
Least-privilege permission declarations .github/workflows/_build.yaml, .github/workflows/_docker.yaml, .github/workflows/_init.yaml, .github/workflows/_release.yaml, .github/workflows/sync-models.yml	Five reusable workflows receive permissions: contents: read at the workflow level to establish secure defaults. Job-level permissions remain unchanged to elevate access only where needed (e.g., packages: write in build, pull-requests: write in sync).
Scope verification .github/workflows/_build.yaml	Workflow trigger blocks and other configurations remain unchanged; only permission declarations are added.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• rocketride-org/rocketride-server#297: Directly related prior work updating workflow-level permissions in the same set of reusable workflow files with identical permission defaults.
• rocketride-org/rocketride-server#261: Related permission governance—both PRs adjust GitHub Actions workflow token permissions to apply least-privilege defaults at the workflow level.

Suggested labels

ci/cd

Suggested reviewers

• kwit75

Poem

🐰 Five workflows stand in a row so neat,
With contents: read in perfect beat,
Least privilege rules the action stage,
SOC2 compliance on each page,
Security thumps its approval deep! 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding top-level permissions to five reusable workflows for security hardening.
Linked Issues check	✅ Passed	All five workflows have been updated with top-level permissions: contents: read blocks immediately after name: declarations, exactly as specified in issue #789.
Out of Scope Changes check	✅ Passed	All changes are within scope of issue #789 Stage 1; no additional modifications to job logic, steps, or unrelated files were introduced.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/workflow-permissions-batch1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

No description provided.

[kwit75]

LGTM — pure additive top-level least-privilege defaults; job-level permissions for write paths preserved (Docker push, tag/release, model-sync PR, SARIF upload). Closes 5 Scorecard alerts. CI green.