[hf-security-analysis]

Automated hardening of the workflow files flagged on #15: job permissions only.

Each kind of fix has its own pull request, from a security/workflow-hardening/pr-15-* branch, and any of them can be merged first: the others are rebuilt on top when this one lands.

Warning

This changes when the workflow runs and what it can reach. Both triggers and permissions were rewritten in .github/workflows/build-pr-dispatch.yaml, .github/workflows/build-windows.yaml, .github/workflows/build.yaml, .github/workflows/nix_fmt.yaml. Read the diff before merging — either one can change what the workflow is able to do.

Targets dependabot/github_actions/actions-c20c00cd42. Files changed, and what changed them:

• .github/workflows/build-pr-dispatch.yaml — job permissions
• .github/workflows/build-windows.yaml — job permissions
• .github/workflows/build.yaml — job permissions
• .github/workflows/nix_fmt.yaml — job permissions

Fixed by this PR:

• HIGH excessive-permissions (zizmor) — .github/workflows/build-pr-dispatch.yaml:11
• MEDIUM excessive-permissions (zizmor) — .github/workflows/nix_fmt.yaml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/nix_fmt.yaml:11
• LOW excessive-permissions (zizmor) — .github/workflows/build-pr-dispatch.yaml:12
• LOW excessive-permissions (zizmor) — .github/workflows/build-windows.yaml:63
• LOW excessive-permissions (zizmor) — .github/workflows/build.yaml:63

This does not fix everything. 4 further finding(s) (3 high, 1 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/build-pr-dispatch.yaml

job	granted	why
dispatch	actions: write, contents: read, statuses: write	actions/checkout needs contents: read, and the 'Dispatch build workflows' step runs .github/scripts/dispatch.py with GITHUB_TOKEN to trigger per-platform workflows (actions: write). statuses: write is kept from the existing grant, presumably for posting PR commit statuses. The script itself is not in this file, so the reviewer should confirm it only dispatches workflows and sets statuses.

.github/workflows/build-windows.yaml

job	granted	why
set-running-status	statuses: write	The 'Set running status' step calls gh api repos/$REPO/statuses/$HEAD_SHA to create a pending commit status, which requires statuses: write.
build-kernel	contents: read	actions/checkout of this repo (and the public huggingface/kernels repo) needs contents: read; uploads go to the Hugging Face Hub via HF_TOKEN, and the install-oneapi.ps1/builder.ps1 scripts receive no GitHub token, so no other scope is needed.
report-status	statuses: write	The 'Set commit status' step calls gh api repos/$REPO/statuses/$HEAD_SHA to post the final commit status, which requires statuses: write.

.github/workflows/build.yaml

job	granted	why
setup	contents: read, statuses: write	The 'Set running status' step POSTs to repos/$REPO/statuses/$HEAD_SHA via gh api (statuses: write), and actions/checkout needs contents: read.
build-kernel	contents: read, id-token: write	The 'Sign kernel metadata' step runs cosign sign-blob keylessly, which needs id-token: write; checkout needs contents: read; no step posts statuses, and upload-artifact plus the Hub uploads (HF_TOKEN) need no GitHub scope.
build-ci-test	contents: read	Only actions/checkout needs contents: read; the nix builds, cachix and same-run upload-artifact need no token scopes.
test-kernel-gpu	{} — nothing	No checkout and no API use; download-artifact from the same run needs no permission.
report-status	contents: read, issues: write, statuses: write	The 'Update bot comment with Hub URLs' step PATCHes repos/.../issues/comments/$BOT_COMMENT_ID (issues: write), and 'Set commit status' posts to the statuses API (statuses: write); checkout needs contents: read, while same-run download-artifact needs no actions: read.

.github/workflows/nix_fmt.yaml

job	granted	why
build	contents: read	actions/checkout needs contents: read; the Nix installer and nix fmt -- --ci run locally and use no repository token scopes.

.github/workflows/pr-comment-build.yaml

handle-comment was left as it is — The final step runs .github/scripts/pr_comment_kernel_bot.py with GITHUB_TOKEN, and that script's contents are not in this file, so its API usage (likely comments/reactions and possibly workflow dispatch, given the workflow-level actions/issues/pull-requests write grants) cannot be verified; checkout and git fetch alone need only contents: read.

.github/workflows/security-audit.yml

job	granted	why
security-audit	contents: read, pull-requests: write	The 'Comment audit result on PR' step runs gh pr comment, which needs pull-requests: write (this also covers gh pr diff); actions/checkout needs contents: read. The existing issues: write grant was dropped because no step touches issues, but if gh pr comment fails without it, re-add it.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Claude decided the scopes each job needs; the YAML was edited by code. Read the table below before merging.