[sec-check] Token-Permissions: 8 job-level write scopes in 6 workflows (Scorecard high)

[clubanderson]

Security Finding

Severity: high
Type: permission-issue
Scorecard Alerts: #869 and related (TokenPermissionsID)

OpenSSF Scorecard flags 8 active alerts across 6 kubestellar/console workflows for job-level write permissions. The correct top-level least-privilege setting (permissions: read-all) is in place, but write scopes at the job level are flagged.

Affected workflows

File	Alerts
.github/workflows/copilot-automation.yml	2
.github/workflows/helm-release.yml	2
.github/workflows/cleanup-screenshots.yml	1
.github/workflows/deploy-checksum.yml	1
.github/workflows/hive-interactive.yml	1
.github/workflows/process-screenshots.yml	1

All flagged jobs follow the correct least-privilege pattern — permissions: read-all at the workflow level with write scopes scoped to individual jobs. Scorecard flags job-level write permissions regardless of the top-level setting.

Impact

If any action or reusable workflow step is compromised via supply-chain attack, the attacker gains write access at the job scope. The helm-release.yml and deploy-checksum.yml workflows push artifacts and checksums — these have elevated supply-chain risk if compromised.

Recommendation

1. Verify all action pins (commit SHAs) in these workflows are current and untampered.
2. For helm-release.yml and deploy-checksum.yml, consider whether write permissions can be further narrowed (e.g., packages: write instead of contents: write).
3. Periodically update commit hash pins for all pinned actions.

---

Filed by sec-check agent (ACMM L6 — full mode)

[github-actions]

🐝 Hi @clubanderson! I'm kubestellar-hive[bot], an automation bot for this repo.

Trusted users — org members and contributors with write access — can mention @kubestellar-hive in a comment to trigger repo automation.
On issues, that mention queues an automated fix attempt. On pull requests, it records extra context for existing automation.
This is not an interactive Q&A bot, so mentions should be treated as requests for automation rather than a conversation.

Automation may take a moment to start, and follow-up happens through workflow activity rather than chat replies.

[clubanderson]

This issue's affected workflows (cleanup-screenshots.yml, deploy-checksum.yml, helm-release.yml, hive-interactive.yml, process-screenshots.yml, copilot-automation.yml) overlap with PR #19604, which already adds inline comments documenting why each job-level write scope is needed. Once #19604 merges, the remaining actionable item is to verify SHA pins are current — that's a periodic maintenance task rather than a code fix.

Deferring until #19604 merges to avoid file conflicts.