chore(security): narrow storage-cleanup.yml permissions to job-level

[anandray]

Summary

Moves actions: write from the workflow-level permissions block to the cleanup job's own permissions block. Top-level default narrows from actions: write + contents: read to contents: read only.

Behavior

Unchanged. The cleanup job's effective permissions stay the same (actions: write + contents: read). The narrowing only affects any future jobs added to this workflow — they'll inherit contents: read by default rather than the broad cleanup token.

Diff

 permissions:
-  actions: write
   contents: read

 jobs:
   cleanup:
     name: Delete old artifacts and caches
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      actions: write
+      contents: read
     steps:

Type

chore (security hardening)

Linked Issue

Fixes #793

Stage tracking

This is Stage 2a of the 3-stage TokenPermissionsID cleanup:

• Stage 1 (✅ chore(security): add top-level permissions to 5 reusable workflows #790 merged): permissions: contents: read added to 5 reusable workflows
• Stage 2a (this PR): narrow storage-cleanup.yml top-level
• Stage 2b (deferred): narrow nightly.yaml top-level — wait for stage-branch rewrite to settle
• Stage 3 (deferred): justify/dismiss 7 job-level write alerts on legitimate release operations

SOC2 Notes

CC7.1 vulnerability management — closes Scorecard alert #528 (TokenPermissionsID). Following SECURITY.md disposition framework: Fixed.

Summary by CodeRabbit

• Chores
  • Updated workflow job permissions to use job-scoped configuration, restricting access to only necessary permissions for improved security.

[github-actions]

No description provided.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 972ab579-cde6-44af-a18c-cb63df1fb59b

📥 Commits

Reviewing files that changed from the base of the PR and between 189453f and 26c2fe3.

📒 Files selected for processing (1)

• .github/workflows/storage-cleanup.yml

---

📝 Walkthrough

Walkthrough

Job-level permissions are explicitly configured in the cleanup job, moving actions: write from top-level scope to the specific job that requires it, while workflow-level permissions default to contents: read, implementing least-privilege principle.

Changes

Workflow Permissions Narrowing

Layer / File(s)	Summary
Job-Level Permissions Configuration .github/workflows/storage-cleanup.yml	Job-scoped permissions block added under jobs.cleanup with actions: write and contents: read, replacing reliance on top-level permissions and narrowing the permission scope to follow least-privilege.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• rocketride-org/rocketride-server#636: Both PRs modify .github/workflows/storage-cleanup.yml and change how permissions are declared across workflow scope levels.

Suggested labels

ci/cd

Suggested reviewers

• kwit75

Poem

🐰 A tidy job with permissions tight,
No wider scope than needed right,
The cleanup runs with just its due,
Least privilege keeps us safer too! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: moving permissions from workflow-level to job-level scope in the storage-cleanup workflow for security hardening.
Linked Issues check	✅ Passed	The PR fully satisfies the requirements in linked issue #793: moves actions:write to job-level permissions, leaves workflow-level at contents:read, maintains identical runtime behavior, and addresses Scorecard #528 and SOC2 CC7.1.
Out of Scope Changes check	✅ Passed	The PR only modifies storage-cleanup.yml permissions as specified in issue #793, with no unrelated changes or scope creep beyond the stated security hardening objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/workflow-permissions-batch2a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[kwit75]

LGTM — clean least-privilege migration. Moves actions: write from top-level to the cleanup job that actually uses it. Effective permissions unchanged for existing job; future jobs added to this workflow will inherit contents: read instead of the broad write token. Closes Scorecard #528. CI green.