From 6d2cf2b0ca22040a78c1dd6e5627bf82891b2db8 Mon Sep 17 00:00:00 2001
From: "Lutar, Stephen P." <stephenlutar2@gmail.com>
Date: Thu, 16 Jul 2026 14:37:39 -0400
Subject: [PATCH] fix(security): job-scope workflow token permissions

Scorecard TokenPermissions: top-level write grants (4 workflow file(s)) narrowed to contents:read; the writes each job actually needs (SARIF upload, releases, OIDC) move to job level.

Signed-off-by: SZL Ops <ops@szlholdings.ai>
---
 .github/workflows/ci.yml        | 3 +++
 .github/workflows/sbom.yml      | 6 ++++--
 .github/workflows/scorecard.yml | 6 +++---
 .github/workflows/trivy.yml     | 3 ++-
 4 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3a47716..d4225c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,6 +4,9 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index 85d9dae..cab06d5 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -10,10 +10,12 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  security-events: write
+  contents: read
 
 jobs:
   sbom:
+    permissions:
+      contents: write
+      security-events: write
     uses: szl-holdings/.github/.github/workflows/reusable-sbom.yml@ebd2128c691b850c84438b671fbb512945933776
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 2304d76..8439df8 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -12,11 +12,11 @@ on:
 
 permissions:
   contents: read
-  security-events: write
-  id-token: write
-  actions: read
 
 jobs:
   scorecard:
+    permissions:
+      security-events: write
+      id-token: write
     uses: szl-holdings/.github/.github/workflows/reusable-scorecard.yml@ebd2128c691b850c84438b671fbb512945933776
     secrets: inherit
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 69ca423..c8266f4 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -12,9 +12,10 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   trivy:
+    permissions:
+      security-events: write
     uses: szl-holdings/.github/.github/workflows/reusable-trivy.yml@ebd2128c691b850c84438b671fbb512945933776
     secrets: inherit