[plan] Fix medium severity security issues (permissions + artifacts) #9125

Objective

Address 2 medium-severity security issues: excessive permissions in layout-spec-maintainer.lock.yml and potential credential leakage in release.lock.yml artifacts.

Issue 1: Excessive Permissions (Medium)

Workflow: .github/workflows/layout-spec-maintainer.lock.yml (line 69)

Problem: The workflow has broader permissions than necessary, increasing the attack surface if compromised.

Current State: Review the workflow's permissions: block

Security Risk:

• If workflow is compromised, attacker has more capabilities
• Violates principle of least privilege
• Increases impact of potential vulnerabilities

Fix Approach:

1. Identify what GitHub API operations the workflow actually performs
2. Grant only the minimum permissions needed
3. Use read-only permissions where possible

Example Fix:

# Before (overly broad)
permissions:
  contents: write
  issues: write
  pull-requests: write
  discussions: write

# After (minimal)
permissions:
  contents: read       # Only needs to read files
  issues: write        # Only needs to create/update issues

Common permission levels:

• read - Read-only access
• write - Read and write access
• none - No access

Issue 2: Artipacked - Credential Persistence (Medium)

Workflow: .github/workflows/release.lock.yml (line 1087)

Problem: Credentials or secrets may be inadvertently included in uploaded GitHub Actions artifacts, potentially leaking sensitive data.

Current State: Review artifact upload steps around line 1087

Security Risk:

• Secrets in artifacts can be downloaded by anyone with repo access
• Artifacts persist even after secrets are rotated
• May expose tokens, API keys, or other credentials

Fix Approach:

Step 1: Identify what's being uploaded

- uses: actions/upload-artifact@v4
  with:
    name: release-assets
    path: |
      dist/**
      # Review this path carefully

Step 2: Exclude sensitive files

- uses: actions/upload-artifact@v4
  with:
    name: release-assets
    path: dist/**
    # Exclude sensitive patterns
    exclude: |
      **/.env
      **/.env.*
      **/secrets.json
      **/*.key
      **/*.pem
      **/.npmrc
      **/.pypirc

Step 3: Audit artifact contents

Before uploading:

- name: Audit artifact contents
  run: |
    echo "Files to be uploaded:"
    find dist/ -type f
    echo "Checking for secrets..."
    ! grep -r "GITHUB_TOKEN\|SECRET\|PASSWORD" dist/ || exit 1

Step 4: Use short retention

- uses: actions/upload-artifact@v4
  with:
    name: release-assets
    path: dist/**
    retention-days: 1  # Minimize exposure window

Files to Modify

For Issue 1 (Permissions):

• .github/workflows/layout-spec-maintainer.md (source)
• Review and update permissions: block

For Issue 2 (Artifacts):

• .github/workflows/release.md (source)
• Review artifact upload steps
• Add exclusion patterns if needed
• Add pre-upload validation

Validation Steps

For excessive permissions:

1. Review workflow code to understand required operations
2. Update permissions to minimum required set
3. Recompile: make recompile
4. Run zizmor: zizmor .github/workflows/layout-spec-maintainer.lock.yml
5. Test workflow still functions correctly

For artipacked:

1. Identify sensitive files that might be in artifacts
2. Add exclusion patterns
3. Add pre-upload audit step
4. Recompile: make recompile
5. Run zizmor: zizmor .github/workflows/release.lock.yml
6. Test a release to verify artifacts don't contain secrets

Acceptance Criteria

• layout-spec-maintainer.lock.yml uses minimal required permissions
• Permissions documented with comments explaining necessity
• release.lock.yml artifacts exclude sensitive files
• Pre-upload validation added to check for secrets
• Both workflows pass zizmor validation
• No "excessive-permissions" warning
• No "artipacked" warning
• Workflows still function correctly after changes

Testing

# After fixes
make recompile

# Run zizmor on both workflows
zizmor .github/workflows/layout-spec-maintainer.lock.yml
zizmor .github/workflows/release.lock.yml

# Verify no medium severity issues remain
gh aw compile --zizmor .github/workflows/layout-spec-maintainer.md
gh aw compile --zizmor .github/workflows/release.md

Additional Security Checks

• Review artifact contents manually after upload
• Ensure no tokens in environment variables during artifact creation
• Verify .gitignore patterns are respected
• Check for accidental inclusion of .git directory
• Confirm artifact retention period is appropriate

References

• GitHub Actions Permissions
• Artifact Security Best Practices
• Zizmor artipacked rule documentation
  Related to [plan] Fix static analysis findings from January 2026 scan #9122

AI generated by Plan Command for discussion #9119