From 1a7f022d03a303d066698885750c4e30d4c86bc2 Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:28:55 +0800 Subject: [PATCH 1/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Add=20least-privileg?= =?UTF-8?q?e=20permissions=20to=20benchmarks=20workflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/benchmarks.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml index ceb73c2..7c99ee0 100644 --- a/.github/workflows/benchmarks.yml +++ b/.github/workflows/benchmarks.yml @@ -18,6 +18,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# AAASM-3993: least-privilege default token — this workflow only checks out and +# runs tests/builds; no job pushes, comments, or deploys. +permissions: + contents: read + jobs: benchmark: name: Run performance benchmarks From e322b89be7ac4110ed9f694cccdc12f7cf9044f1 Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:28:56 +0800 Subject: [PATCH 2/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Add=20least-privileg?= =?UTF-8?q?e=20permissions=20to=20CI=20workflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/ci.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index e911281..f89ae41 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -59,6 +59,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# AAASM-3993: least-privilege default token — this workflow only checks out and +# runs tests/builds; no job pushes, comments, or deploys. +permissions: + contents: read + jobs: build-and-test_all: # name: Run all tests and organize all test reports From 8c1e5dd3e1f6e5d8c5cd6633c66a895600306b7f Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:28:56 +0800 Subject: [PATCH 3/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Add=20least-privileg?= =?UTF-8?q?e=20permissions=20to=20CI+E2E=20workflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/ci_includes_e2e_test.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci_includes_e2e_test.yaml b/.github/workflows/ci_includes_e2e_test.yaml index 68716ef..c121cb6 100644 --- a/.github/workflows/ci_includes_e2e_test.yaml +++ b/.github/workflows/ci_includes_e2e_test.yaml @@ -25,6 +25,11 @@ on: - "pyproject.toml" - "uv.lock" +# AAASM-3993: least-privilege default token — this workflow only checks out and +# runs tests/builds; no job pushes, comments, or deploys. +permissions: + contents: read + jobs: build-and-test_all: # name: Run all tests and organize all test reports From cf4a9d84a1a72b86c1ae456066d7eb502926be65 Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:28:57 +0800 Subject: [PATCH 4/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Add=20least-privileg?= =?UTF-8?q?e=20permissions=20to=20native-core-build=20workflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/native-core-build.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/native-core-build.yml b/.github/workflows/native-core-build.yml index bc6f3ee..241250d 100644 --- a/.github/workflows/native-core-build.yml +++ b/.github/workflows/native-core-build.yml @@ -14,6 +14,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# AAASM-3993: least-privilege default token — this workflow only checks out and +# runs tests/builds; no job pushes, comments, or deploys. +permissions: + contents: read + jobs: build-native-core: runs-on: ubuntu-latest From 53b5d801dd7bffd8bd51650723716fc0e2cdecce Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:28:57 +0800 Subject: [PATCH 5/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Add=20least-privileg?= =?UTF-8?q?e=20permissions=20to=20type-check=20workflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/type-check.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/type-check.yml b/.github/workflows/type-check.yml index 678c28b..db55ed9 100644 --- a/.github/workflows/type-check.yml +++ b/.github/workflows/type-check.yml @@ -37,6 +37,11 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +# AAASM-3993: least-privilege default token — this workflow only checks out and +# runs tests/builds; no job pushes, comments, or deploys. +permissions: + contents: read + jobs: verify-pep561-compliance: name: Verify PEP 561 Compliance From f54a18d0499bb5921bbe2ce4734e512bcf74b389 Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:29:18 +0800 Subject: [PATCH 6/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Add=20least-privileg?= =?UTF-8?q?e=20permissions=20to=20rw=5Fbuild=5Fand=5Ftest=20workflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/rw_build_and_test.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/rw_build_and_test.yaml b/.github/workflows/rw_build_and_test.yaml index 7d62ebe..9b64daa 100644 --- a/.github/workflows/rw_build_and_test.yaml +++ b/.github/workflows/rw_build_and_test.yaml @@ -18,6 +18,11 @@ on: description: "Set the Slack bot token for end-to-end test." required: false +# AAASM-3993: least-privilege default token. As a reusable workflow this also caps +# the GITHUB_TOKEN granted to the third-party workflows it calls; none need write. +permissions: + contents: read + jobs: run_unit-test: # name: Run all unit test items From 10d45f1cfaab128525cc5d8c733183c8716932b5 Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:29:18 +0800 Subject: [PATCH 7/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Add=20least-privileg?= =?UTF-8?q?e=20permissions=20to=20rw=5Frun=5Fall=5Ftest=5Fand=5Frecord=20w?= =?UTF-8?q?orkflow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/rw_run_all_test_and_record.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/rw_run_all_test_and_record.yaml b/.github/workflows/rw_run_all_test_and_record.yaml index b4c829d..bb5ba7c 100644 --- a/.github/workflows/rw_run_all_test_and_record.yaml +++ b/.github/workflows/rw_run_all_test_and_record.yaml @@ -24,6 +24,11 @@ on: description: "The API token for uploading testing coverage report to Coveralls." required: false +# AAASM-3993: least-privilege default token. As a reusable workflow this also caps +# the GITHUB_TOKEN granted to the third-party workflows it calls; none need write. +permissions: + contents: read + jobs: build-and-test: # name: Run all tests and organize all test reports From c82f30abbb77ad09fe92ba9ba60eabae91661468 Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:29:34 +0800 Subject: [PATCH 8/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Document=20third-par?= =?UTF-8?q?ty=20reusable-wf=20trust=20+=20secret=20scope=20in=20rw=5Fbuild?= =?UTF-8?q?=5Fand=5Ftest?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/rw_build_and_test.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/rw_build_and_test.yaml b/.github/workflows/rw_build_and_test.yaml index 9b64daa..15899b2 100644 --- a/.github/workflows/rw_build_and_test.yaml +++ b/.github/workflows/rw_build_and_test.yaml @@ -24,6 +24,13 @@ permissions: contents: read jobs: + # AAASM-3994: these jobs call a third-party reusable workflow owned by a personal + # account (Chisanan232/GitHub-Action_Reusable_Workflows-Python). Trust is bounded + # by the 40-char commit-SHA pin on each `uses:` below — a moving tag/branch would + # let the owner alter behavior after review. Secrets are already scoped per call: + # only run_e2e-test receives e2e_test_api_token (Slack); unit/integration forward + # none. TODO(AAASM-3994): vendor this workflow into the ai-agent-assembly org (or + # pin a signed release) to drop the personal-account supply-chain dependency. run_unit-test: # name: Run all unit test items uses: Chisanan232/GitHub-Action_Reusable_Workflows-Python/.github/workflows/rw_uv_run_test.yaml@4a6480470b90c0b6139e05489868585fa50aad6f # master @ 2026-05-26 From 755adf41292bcd8fef778ea5ec5e72ccd83fa50d Mon Sep 17 00:00:00 2001 From: Bryant Date: Thu, 2 Jul 2026 13:29:34 +0800 Subject: [PATCH 9/9] =?UTF-8?q?=F0=9F=94=A7=20(ci):=20Document=20third-par?= =?UTF-8?q?ty=20reusable-wf=20trust=20+=20secret=20scope=20in=20rw=5Frun?= =?UTF-8?q?=5Fall=5Ftest=5Fand=5Frecord?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01MvjnG3ysnqTY6Gu1wQ2h73 --- .github/workflows/rw_run_all_test_and_record.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/rw_run_all_test_and_record.yaml b/.github/workflows/rw_run_all_test_and_record.yaml index bb5ba7c..4704c98 100644 --- a/.github/workflows/rw_run_all_test_and_record.yaml +++ b/.github/workflows/rw_run_all_test_and_record.yaml @@ -39,6 +39,14 @@ jobs: secrets: e2e_test_api_token: ${{ secrets.e2e_test_api_token }} + # AAASM-3994: the *_codecov_finish jobs below call a third-party reusable workflow + # owned by a personal account (Chisanan232/GitHub-Action_Reusable_Workflows-Python). + # Trust is bounded by the 40-char commit-SHA pin on each `uses:` — a moving ref + # would let the owner alter behavior after review. Secrets are already minimized: + # each call forwards ONLY codecov_token; sonar_token is used solely by the local + # sonarcloud_finish job (SonarSource action) and never forwarded to the third party. + # TODO(AAASM-3994): vendor this workflow into the ai-agent-assembly org (or pin a + # signed release) to drop the personal-account supply-chain dependency. unit-test_codecov_finish: # name: Organize and generate the testing report and upload it to Codecov if: ${{