SRE-901: Stop handing CI more Vault reach than it uses

[TimDiekmann]

Applies the CI Vault narrowing from hashintel/hash#9160 to this repo.

• secrets: inherit dropped from the renovate job. The pinned reusable workflow reads no secrets.* — the Vault address comes from vars.VAULT_ADDR, a repo variable, which secrets: inherit never carried.
• contents: write → read. The reusable workflow declares contents: read for itself, so the Renovate job's token is already read-only in the current scheduled runs. The caller-side write only reached this workflow's own validate job, which checks out and runs jq/actionlint.

Related links

• SRE-901 (internal)
• SRE-901: Stop handing CI more Vault reach than it uses hash#9160 — the same change in hash

What tests cover this?

actionlint v1.7.12 on the changed file: clean. Renovate is proven green under contents: read, since that is already its effective permission today.

[cursor]

PR Summary

Low Risk
Permission narrowing with no functional change to Renovate behavior; reduces blast radius if CI is compromised.

Overview
Tightens GitHub Actions permissions on the housekeeping workflow so CI gets only what Renovate actually needs.

Workflow-level contents is downgraded from write to read, matching that the reusable Renovate workflow already runs with read-only repo access and the local validate job only lints config—it does not push changes from this workflow file.

The renovate job no longer uses secrets: inherit, since the pinned reusable workflow does not consume repository secrets (Vault is wired via vars.VAULT_ADDR). That removes unnecessary secret exposure if a job or action were compromised.

^{Reviewed by Cursor Bugbot for commit 9c842d5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

🟡 Changes recommended

id-token: write remains granted at the workflow level (affecting the PR-running validate job) and should be scoped to the renovate job to fully achieve least-privilege OIDC/Vault access.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR hardens the Housekeeping GitHub Actions workflow by reducing the default token/secrets exposure for the Renovate (dependencies) job, aligning with the “narrow CI Vault reach” goal.

Changes:

• Reduce workflow contents permission from write to read.
• Remove secrets: inherit from the renovate reusable-workflow call.

File summaries

File	Description
.github/workflows/housekeeping.yml	Narrows default GITHUB_TOKEN permissions and stops inheriting secrets for the Renovate reusable workflow call.

Review details

Suppressed comments (1)

.github/workflows/housekeeping.yml:69

• After removing secrets: inherit, this job still needs OIDC for Vault access. If you apply the workflow-level permission tightening (dropping id-token: write), add explicit job-level permissions here so only renovate can mint an OIDC token.

    uses: hashintel/.github/.github/workflows/housekeeping-dependencies.yml@9957be5b132761d8b54dea2eb3166f417ebacaf9 # main
    with:
      repoCache: ${{ inputs.repoCache || 'enabled' }}
      logLevel: ${{ inputs.logLevel || 'info' }}
      overrideSchedule: ${{ inputs.overrideSchedule || false }}

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.