Security: Missing workflow `permissions` blocks in GitHub Actions (CodeQL alerts #14/#17/#24/#29/#31/#32)
Author: nthmost-orkesCreated Sep 17, 2026Updated Sep 17, 2026
Labelssecurity
CodeQL · rule actions/missing-workflow-permissions · severity medium
Sub-issue of #1010.
Jobs run with the default (broad) `GITHUB_TOKEN` scope because no explicit `permissions:` block is declared. Open alerts:
| Alert | File | Line |
|---|---|---|
| #14 | `.github/workflows/ci.yml` | 314 |
| #17 | `.github/workflows/ci.yml` | 39 |
| #29 | `.github/workflows/ci.yml` | 134 |
| #31 | `.github/workflows/ci.yml` | 205 |
| #32 | `.github/workflows/ci.yml` | 227 |
| #24 | `.github/workflows/debug-docker-credentials.yml` | 8 |
Note: #31 and #32 are new since the epic was last updated (2026-04-14).
Fix direction
Add a least-privilege `permissions:` block (default `contents: read`, elevating per-job only where needed). Prefer a top-level default plus job-level overrides.
Source: conductor-oss/conductor