[security-fix] Security Fix: Add explicit permissions to license-check workflow (Alert #74)

[github-actions]

Security Fix: Missing Workflow Permissions

Alert Number: #74
Severity: Medium (Warning)
Rule: actions/missing-workflow-permissions
Location: .github/workflows/license-check.yml

Vulnerability Description

CodeQL detected that the license-check.yml workflow does not contain an explicit permissions block. Without explicit permissions, workflows inherit repository or organization default permissions, which may be overly permissive (read-write access) and violate the principle of least privilege.

This security issue could allow the workflow to:

• Potentially access or modify repository content beyond what's necessary
• Expose the GITHUB_TOKEN with more permissions than required
• Create security risks if the workflow is compromised

Fix Applied

Added a minimal permissions block to the workflow with only the permissions necessary for its operation:

permissions:
  contents: read

This restricts the workflow to:

• contents: read - Required for the actions/checkout action to clone the repository
• No write permissions - The workflow only reads dependencies and generates reports, it doesn't need to write to the repository

Security Best Practices Applied

✅ Principle of Least Privilege: Workflow only has the minimum permissions needed
✅ Explicit Permissions: Clearly documents what access the workflow requires
✅ Defense in Depth: Reduces attack surface if workflow or dependencies are compromised
✅ CWE-275 Compliance: Addresses Permission Issues (CWE-275)

Testing Considerations

• ✅ Workflow functionality unchanged - only permissions restricted
• ✅ No breaking changes to the license checking logic
• ✅ Artifact upload still works (implicit permissions for actions)
• ✅ All existing functionality preserved with enhanced security

Workflow Operations That Still Work

1. ✅ Checkout repository (actions/checkout)
2. ✅ Setup Go environment (actions/setup-go)
3. ✅ Install and run go-licenses tool
4. ✅ Upload license report artifacts (actions/upload-artifact)

Impact Assessment

Risk: None
Breaking Changes: None
Backwards Compatibility: Full

This is a security-only enhancement that restricts permissions without affecting functionality. The workflow will operate exactly as before, but with improved security posture.

References

• CodeQL Alert: https://github.com/githubnext/gh-aw/security/code-scanning/74
• GitHub Docs: Assigning permissions to jobs
• CWE-275: Permission Issues
• Security Best Practice: GITHUB_TOKEN permissions should always be scoped to minimum required

Files Modified

• .github/workflows/license-check.yml: Added permissions: contents: read block

---

🤖 Generated with [Claude Code]((redacted)

Co-Authored-By: Claude Sonnet 4.5 (noreply@anthropic.com)

AI generated by Security Fix PR

---

Note

This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available as an artifact (aw.patch) in the workflow run linked above.
To apply the patch locally:

# Download the artifact from the workflow run https://github.com/githubnext/gh-aw/actions/runs/20455172175
# (Use GitHub MCP tools if gh CLI is not available)
gh run download 20455172175 -n aw.patch
# Apply the patch
git am aw.patch

Show patch (40 lines)

From 004a9a7748ce97ab8241f7cd05a7e7f491c921f7 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Tue, 23 Dec 2025 08:10:09 +0000
Subject: [PATCH] Security fix: Add explicit permissions to license-check
 workflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes CodeQL alert #74 by adding a minimal permissions block that restricts
the workflow to only 'contents: read', following the principle of least privilege.

This prevents the workflow from inheriting overly permissive default repository
permissions while maintaining all existing functionality.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .github/workflows/license-check.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/license-check.yml b/.github/workflows/license-check.yml
index 69063c9..8a5088e 100644
--- a/.github/workflows/license-check.yml
+++ b/.github/workflows/license-check.yml
@@ -9,6 +9,9 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   license-check:
     runs-on: ubuntu-latest
-- 
2.52.0