Repository navigation
fix(ci): check:workflows does not require permissions: — the #118 GITHUB_TOKEN fallback class has no regression net #1503
Description
Problem
check:workflows — the gate built by #1406 to turn workflow policy from convention into a regression net — does not check permissions:. #118 fixed the instances (six workflows declared no permissions and fell back to the repo-default GITHUB_TOKEN), but no gate prevents the next workflow from landing the same way: a new or edited workflow with no permissions: at workflow or job level passes every wired check while its token silently inherits the repo defaults.
Evidence (verified this run, 2026-11-03, clean laptop probe worktree at origin/main d370a29)
- The gate's own header (
script/check-workflows.ts:1-35) lists exactly three policies: nopull_request/pull_request_targettriggers,workflow_dispatchdeclared, andtimeout-minuteson every non-reusable job (plus the reusable-caller key allowlist).permissionsappears in that file only once, as an allowed key on reusable-workflow caller jobs (script/check-workflows.ts:54) — never as a requirement. - The gate is green today:
bun script/check-workflows.tsexits 0 with "All 29 workflows in .github/workflows follow the workflow policies". - Current state is clean, so this is a net gap, not a live exposure: every one of the 29 workflow files declares
permissions:at least once (top-level or job-level; verified by grep over.github/workflows/*.yml— e.g.check.ymltop-levelcontents: read,review.ymljob-levelcontents: read+pull-requests: write,stats.ymljob-levelcontents: write). - The class has already regressed once by hand: CI: six workflows across opencode + openchamber declare no permissions — GITHUB_TOKEN falls back to repo defaults (set) #118 ("six workflows declare no permissions — GITHUB_TOKEN falls back to repo defaults") was caught and fixed manually, exactly how the timeout policy regressed twice before fix(ci): no gate enforces the workflow policies — PR triggers, workflow_dispatch, and per-job timeouts are convention only #1406 gated it (fix(ci): test.yml's ci-fix job has no timeout-minutes — per-job gap the file-level check cannot see (#61 rule) #1326, fix(ci): branch-cleanup workflow job has no timeout-minutes — the one runnable job that regressed #61's cap rule #1184, cited in the gate's own header).
Why it matters
This fork's workflows hold write tokens on purpose (contents: write, pull-requests: write, id-token: write in several). The one workflow that forgets to declare permissions does not fail closed — it runs with whatever the repo default grants, and nothing in CI notices. The repo's established pattern for exactly this situation is a gate policy (#1406, #1481, #1494, #1500); permissions is the remaining #118-class policy still enforced by convention only.
Acceptance criteria
-
script/check-workflows.tsfails a workflow in which any job would run without an applicablepermissions:declaration (workflow-level or job-level), with reusable-workflow caller jobs handled consistently with the existing caller-key policy. -
script/check-workflows.test.tsgains fixture coverage: a workflow with no permissions anywhere fails, a job-level-only declaration passes, a workflow-level-only declaration passes. - The gate stays green on the current 29 workflows (
bun script/check-workflows.tsexits 0) andbun run check:workflowsremains the wired CI entry.
Activity
dezren39 commentedon Nov 3, 2026
🤖 Agent note · state: filed
bun script/check-workflows.tsexits 0 over all 29 workflows, every workflow currently declarespermissions:(top- or job-level), and the gate's source contains no permissions requirement — the CI: six workflows across opencode + openchamber declare no permissions — GITHUB_TOKEN falls back to repo defaults (set) #118 fallback class is convention-only again.27 remaining items
fix(ci): complete documented permission scopes; stale-check exception…
dezren39 commentedon Nov 4, 2026
agent-note:v1
state: picked-up
queue: repo-health-opencode-pilot
task: 6809 (small_fix, worker repo-worker-opencode, lane 3fe37e8a-c61b-419c-9e97-769ecd264d5d)
by: openchamber-scheduled-lane
at: 2026-11-04T05:44:42Z
Claimed and freshly revalidated #1503, PR #1594, and the related PR #1504. The issue is open; both PRs are open and authored by dezren39 (Drewry Pope). Hard stop: do not edit or merge either Drew-owned PR.
dezren39 commentedon Nov 4, 2026
agent-note:v1
state: parked
queue: repo-health-opencode-pilot
task: 6809 (parked, worker repo-worker-opencode, lane 3fe37e8a-c61b-419c-9e97-769ecd264d5d)
by: openchamber-scheduled-lane
at: 2026-11-04T05:45:26Z
Task 6809 parked for 30 minutes because the current PR #1594 and related PR #1504 are open and Drew-authored. No edits or merge performed. Resume only after fresh evidence clears ownership restrictions, then revalidate reviews, checks, and diff.
dezren39 commentedon Nov 4, 2026
agent-note:v1
state: parked
queue: repo-health-opencode-pilot
task: 6809 (parked, worker repo-worker-opencode, lane 3fe37e8a-c61b-419c-9e97-769ecd264d5d)
by: openchamber-scheduled-lane
at: 2026-11-04T06:45:33Z
Task 6809 parked for 30 minutes after fresh verification: issue #1503 is open; PR #1594 (head 70bd31b) and related PR #1504 (head ab20d93) are open and authored by dezren39 (Drewry Pope). No edits or merge performed. Existing labels already reflect parked/assigned state. Resume only after fresh evidence clears ownership restrictions, then revalidate checks and review the diff.
dezren39 commentedon Nov 4, 2026
agent-note:v1
state: picked-up
queue: repo-health-opencode-pilot
task: 6809 (small_fix, worker repo-worker-opencode, lane 3fe37e8a-c61b-419c-9e97-769ecd264d5d)
by: openchamber-scheduled-lane
at: 2026-11-04T06:41:57Z
Claimed task 6809 and began fresh revalidation of #1503 and related PRs #1594/#1504. Prior ownership evidence was stale; no files or PRs were touched before verifying current GitHub state.
Merge pull request #1594 from developing-today/queue/6809-1503-workfl…
dezren39 commentedon Nov 4, 2026
Done — PR #1594 merged (2026-11-04, task 6809)
PR #1594 merged as
53f06c2ead83525e6033ee7b7cf967a5d8eaa149at 2026-11-04T07:19:40Z; this issue auto-closed on merge.check:workflowsnow carries the permissions policy.Final verification at head
70bd31b26c3f88e27cdf6cbd89dff9279d5dc15c: Codex review state (summary 6622068579) reportshas_any_findings: false, has_unresolved_findings: falseat that head, receipt 6623187018 clean. The two P2 findings from the earlier head (4463396680 documented permission scopes, 4463396684 stale exceptions for deleted/renamed workflows) were both fixed at this head and answered on their threads; tests 34/34 and the gate green were recorded by the implementing shift. Queue/parked/work labels are being cleaned with this note.