CI least privilege: permissions {} by default, cache-mode none on pull requests, workflow policy tripwire

[seathatflowsinourveins]

Scope

• What this PR changes, in one or two sentences: GitHub Actions least privilege for all 21 workflows, from bounded job 004's cross-family consensus on agent-authored pull requests. Top-level permissions: {} with job-level grants, cache-mode: none on pull request workflows and the release workflow, a restore/save split for the one cache, concurrency groups on six more workflows, and a parsing tripwire (tests/test_workflow_policy.py, 13 rules, 39 planted violations, a pedantic zizmor pass over the five named audits). This is the defense-in-depth layer for main. The primary control is the trusted pre-push gate in the resolver (OpenHands resolver: host driver, one owner issue to one draft PR (stages 1-2, offline-tested) #489).
• Base commit: ba0e8c48f (rebased onto origin/main). Three commits:
  • 8f284e2bc holds the content.
  • dbba0ba09 is repair round 1.
  • de0b00438 touches only manifests/evidence.json.
• Lane: lane:shared (it changes .github/workflows/** and manifests/evidence.json, which both lanes use; it needs the other lane's acknowledgement before merge)
• Owned paths touched:
  • .github/workflows/**: 19 of 21 files. native-offhost-app-state.yml and native-offhost-restore.yml stay byte-identical, see Residuals.
  • Tests: tests/test_workflow_policy.py (new) and seven existing workflow test modules.
  • Docs: docs/decisions/2026-10-04-ci-least-privilege.md (new); the stale contents: read sentences in docs/github-automation.md; the checklist line in .github/pull_request_template.md.
  • manifests/evidence.json (last commit).

SOTA sources

• GitHub Docs, read at github/docs 2bd66de8cea336061c9ea060c9b37385136e6ab3:
  • Secure use reference (least-privilege GITHUB_TOKEN, pull_request_target/workflow_run, self-hosted runners): https://docs.github.com/en/actions/reference/security/secure-use
  • Workflow syntax (permissions, including permissions: {}; cache-mode; concurrency; timeout-minutes): https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
  • Dependency caching ("Restrictions for accessing a cache", "Cache access for low-trust workflow triggers", "Controlling cache access with cache-mode", "Best practices for using caches securely"): https://docs.github.com/en/actions/reference/workflows-and-actions/dependency-caching. cache-mode was documented on 2026-09-10 (be60fe442256).
  • GitHub-hosted runners, "Standard GitHub-hosted runners for public repositories" (the runner allowlist): https://docs.github.com/en/actions/reference/runners/github-hosted-runners. Source: data/reusables/actions/supported-github-runners.md and single-cpu-table-row.md, last changed 2026-09-17 (eb8f32b5dd88), read 2026-10-04.
• actions/runner src/Sdk/DTObjectTemplating/ObjectTemplating/TemplateReader.cs (ParseScalar: literal and expression segments become a format() expression) at d7bc179baf11a02110b46cfbbc4040f74ac3f60a.
• OpenSSF Scorecard docs/checks.md (Token-Permissions, Dangerous-Workflow) at f1ebd76756593c0454d782b4ba36ebc33ad131b6: https://github.com/ossf/scorecard/blob/main/docs/checks.md. In checks/raw/permissions.go (validatePermissions) and checks/evaluation/permissions.go, a top-level {} is recorded as the none level and logged without a score reduction.
• zizmor v1.30.1 (tag 99a054ed9283c90abdd2d5b9fb5101d27dde9783):
  • docs/audits.md: excessive-permissions (remediation: permissions: {} at the workflow level), dangerous-triggers, cache-poisoning, artipacked, template-injection, concurrency-limits. https://docs.zizmor.sh/audits/
  • docs/usage.md: personas, exit codes, --no-ignores.
  • docs/configuration.md: discovery, --no-config.
• actions/cache v6.1.0 (55cc8345863c7cc4c66a329aec7e433d2d1c52a9): restore/action.yml (cache-hit, cache-primary-key), save/README.md ("Always save cache").
• actions/setup-go b7ad1dad31e06c5925ef5d2fc7ad053ef454303e and actions/setup-node 820762786026740c76f36085b0efc47a31fe5020 action.yml: the cache defaults the tripwire encodes.
• kjanat/actionlint v1.17.0 CHANGELOG.md (cache-mode support); release archive SHA-256 620abd485a12b6ab1125b844a876414e1d5bd2af8a3125b27f82b01d0d9d6e5a, as pinned in validate.yml.
• Bounded job 004 verdict (GPT-6.1 Sol, max, read-only, 2026-10-04T03:03Z) and the job-005 cross-family review of deea517e; both are coordinator state, summarized in the decision record.
• Adoption check: curl/curl .github/workflows/checkurls.yml sets permissions: {} and cache-mode: none (commit 58df614c86, 2026-09-10), and its pull_request run 37171996464 succeeded on 2026-10-04.

Repair round 1

The cross-family review of deea517e (job-005, GPT-6.1 Sol max) returned REJECT, with three findings in tests/test_workflow_policy.py. All three are fixed in dbba0ba09, each with planted controls that fail with the rule named:

1. P1: pull-request-secret read only the raw text. A YAML escape hid a reference GitHub evaluates: TOKEN: "${{ secrets.NPM_TOKEN }}" decodes to ${{ secrets.NPM_TOKEN }}, and the old scan found nothing. The rule now reads the loader's decoded keys, values and sequence items, and secrets: inherit on decoded keys. The raw scan stays as a second net that also covers comments. New controls:

   • a \u escape and a \x escape;
   • a folded block scalar and a literal block scalar;
   • secrets: inherit under a quoted key and under an escaped key.

   The reviewer's fixture in a copy of token-report.yml now fails, with \u, \x and \U escapes alike.

2. P2: runner-label was a prefix pattern, so ubuntu-owned-private passed. It is now an exact allowlist of GitHub's 20 documented standard hosted labels in the ubuntu, windows and macos families, with the docs source and date in the comment. xcode-27 (public preview) and larger runners are left out. New control: ubuntu-owned-private.

3. P2: excludes_pull_request accepted a mixed value such as ${{ !cancelled() }} && github.event_name != 'pull_request'. actions/runner evaluates that as a truthy format() string. Now only a whole ${{ ... }} expression or a bare expression can exclude pull requests. New controls: the reviewer's job-level case, and the same shape on a cache save step. A direct test covers the accepted and refused forms.

Evidence-class table

Claim	Evidence class	Command / receipt
All 21 workflows pass the pinned linter with ShellCheck	local_integration	actionlint 1.17.0 + ShellCheck 0.9.0: exit 0, "Found 0 errors in 21 files"
zizmor finds nothing at the gate's persona	local_integration	zizmor --offline --no-config --no-ignores --persona regular --strict-collection .: exit 0, no findings
None of the five named audits fires at the pedantic persona	local_integration	pedantic: exit 12, 39 findings (36 anonymous-definition, 3 concurrency-limits), 0 from the five audits (base: 45)
Each tripwire rule fails its planted workflows, and only that rule	synthetic	tests.test_workflow_policy: 39/39 planted, 13/13 rules, 6/6 accepted variants pass
The strict loader matches PyYAML	local_integration	uv + PyYAML 6.0.3: 21/21 workflows, 39/39 parseable planted and accepted variants
cache-mode and jobs with no token scope work on this repository	native_proven (hosted)	At the previous head deea517e, 10 of 11 pull-request runs passed, including action-compatibility (run 37180226444, three jobs with no scope) and validate (run 37180226397). adoption-bootstrap was still running when superseded. Runs at de0b00438 are pending.
cache-mode is accepted on github.com	source_review	GitHub docs at 2bd66de8; curl/curl run 37171996464

Local commands run

At head de0b00438340ac214e566516c03feb836d91da82 (base ba0e8c48f), nice 19:

Command	Exit	Result
actionlint -no-color (kjanat/actionlint 1.17.0, ShellCheck 0.9.0 on PATH)	0	Found 0 errors in 21 files
zizmor --offline --no-config --no-ignores --no-progress --persona regular --strict-collection . (1.30.1)	0	no findings (42 hidden by the persona; --no-ignores is set)
same at --persona pedantic --format json	12	39 findings (36 anonymous-definition, 3 concurrency-limits), none from the five audits
python3 -m unittest tests.test_workflow_policy (system Python 3.13, no PyYAML)	0	Ran 27 tests, OK (skipped=1: the PyYAML cross-check)
uv run --with pyyaml==6.0.3 python3 -m unittest tests.test_workflow_policy	0	Ran 27 tests, OK
the 14 workflow modules* (system Python)	0	Ran 633 tests, OK (skipped=38)
the 14 workflow modules* (uv + PyYAML 6.0.3)	0	Ran 633 tests, OK (skipped=21)
python3 scripts/validate.py	0	passed (hashed_files 9817, receipts 194)
python3 scripts/component_matrix.py --check	0	{"rows": 32, "status": "checked"}
python3 scripts/new_host_grand_list.py --check	0	{"status": "passed", "layers": 32, "winners": 66}

* tests.test_workflow_policy tests.test_workflow_hardening tests.test_workflow_security tests.test_workflow_security_coverage tests.test_zizmor_negative_control tests.test_sota_sources_gate tests.test_saturation_ledger tests.test_adoption_bootstrap_macos tests.test_catalog_freshness_propose tests.test_shell_parser_ci tests.test_runtime_worker_skills tests.test_active_recovery_plans tests.test_receipt_staleness tests.test_practice_references

Negative controls: 39/39 planted workflows fail with exactly their rule (13/13 rules covered; 8 for pull-request-secret, 4 for runner-label). 6/6 accepted variants pass. 5/5 zizmor audit fixtures fire at the pedantic persona.

The whole suite ran at the pre-rebase head 6582ba7c3, with the same workflows and the tripwire before repair round 1: python3 -m unittest, exit 1. It ran 10226 tests with 2 failures and 887 skipped, and neither failure is caused by this change:

• tests.test_windows_terminal_defaults fails identically at the base: the host's installed client knows auth_storage_failure.
• tests.test_adaptive_paper_metrics hit an exporter startup timeout under load. It passes 3/3 alone and reads no workflow.

Decision record

docs/decisions/2026-10-04-ci-least-privilege.md: the consensus, the sources, the change for each workflow, the residuals, repair round 1, the alternatives considered and the comparison that would overturn it.

Residuals

1. The commit under test can edit the workflows and this tripwire before CI runs. The trusted pre-push gate (OpenHands resolver: host driver, one owner issue to one draft PR (stages 1-2, offline-tested) #489) is the control. This layer catches regressions on main and in human pull requests.
2. native-offhost-app-state.yml and native-offhost-restore.yml stay byte-identical. Their recovery plans (blueprints/convergence-practice/offhost-app-state/plan.json, offhost-restore/hosted-plan.json) bind their SHA-256, and tests/test_active_recovery_plans.py checks those bindings. Both are dispatch-only and keep a workflow-level contents: read. The tripwire names them in HASH_BOUND, and the exemption fails once a binding moves. Follow-up: refresh both bindings and move both files to permissions: {} with a concurrency group.
3. bootstrap-macos keeps GitHub's trigger cache default. cache-mode takes no expression, and read would block the trusted-event save. Its save step runs on trusted events only, and a pull request's cache entries stay scoped to its merge ref.
4. Hosted evidence is partial.
   • At deea517e, 10 of 11 runs passed. adoption-bootstrap, which holds the restore/save split, had not finished, so the split is still unproven on a hosted runner.
   • The runs at de0b00438 are this head's own evidence.
5. The runner check is an exact allowlist of names. A hosted-style name such as ubuntu-owned-private now fails. It still cannot prove where a job runs if a self-hosted runner were registered under an allowlisted label. The repository registers none.

Host evidence

Not applicable: no file under evidence/hosts/ changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). (actions/cache/restore and actions/cache/save use the existing actions/cache v6.1.0 pin.)
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition).
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

Cross-family review record

• job-005 (GPT-6.1 Sol max, standard tier, head deea517): REJECT with 1 P1 and 2 P2. Repaired in round 1 (dbba0ba).

• job-006 delta (head de0b004): P1 closed, and P2-runner closed. P2-expr is partly open, with two precision residuals in excludes_pull_request (tests/test_workflow_policy.py L433-436):

  1. condition.strip() drops literal whitespace outside the expression, so "${{ github.event_name != 'pull_request' }} " (trailing space) is accepted, although GitHub reads it as a mixed literal.
  2. The }} substring check falsely rejects a valid guard with }} inside a string literal, such as contains('a}}b', 'a').

  Both are fixed in the follow-up PR that folds Workflow hardening: no pull-request job reads a secret or holds a new write scope #682's unique assertions into this test, under the bounded-review rule of one repair round with residuals recorded. Neither affects any workflow in this PR: no changed workflow uses either form.

🤖 Generated with Claude Code

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 8e92d1bc07a588d2922058f819fe647a9d1cf6b3. The command center (wsl-architecture-design) gave its ACK at de0b00438340, which reaches this head only through recorded mechanical refreshes whose owned non-registry patch-ids are equal (its carry rule); under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned REJECT at deea517e91d1; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with its 1 P1 item(s) resolved in one repair round as recorded.

Observed main 33efbc3b6a46df556bdedf39cd8ea65762f38867. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main 33efbc3b6a46df556bdedf39cd8ea65762f38867 head 8e92d1bc07a588d2922058f819fe647a9d1cf6b3 base f77a35eb2bf30bc4bf6f3b4ee51bc9ce5397b4c5 merged-tree 19820e4793ce855e3439a9f3bd27e123c4de51c8 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 31, outside PR-owned 0 []
ok   3: main drift 14 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 30, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (9878 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 19820e4793ce855e3439a9f3bd27e123c4de51c8)

Required checks at this head: 8 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as 6af8e55bd9e8f51aaafbf0304e510c11aaa71a6a (parent 33efbc3b6a46df556bdedf39cd8ea65762f38867), tree 19820e4793ce855e3439a9f3bd27e123c4de51c8. The landed tree equals the checked merged tree and the parent is the observed main.