ci: restrict Rust workflow token permissions

Author: KooshaPari

.github/scripts/test_verify_required_ci.py

@@ -21,6 +21,39 @@ def setUpClass(cls) -> None:
     def test_repository_workflow_satisfies_contract(self) -> None:
         self.assertEqual([], verify_required_ci.contract_errors(self.workflow))
 
+    def test_missing_rust_ci_token_permissions_are_rejected(self) -> None:
+        broken = self.workflow.replace(
+            "permissions:\n  contents: read\n\n", "", 1
+        )
+        self.assertIn(
+            "Rust CI token permissions must be exactly contents: read",
+            verify_required_ci.contract_errors(broken),
+        )
+
+    def test_broader_rust_ci_token_permissions_are_rejected(self) -> None:
+        for replacement in (
+            "permissions:\n  contents: write",
+            "permissions:\n  contents: read\n  actions: read",
+        ):
+            with self.subTest(replacement=replacement):
+                broken = self.workflow.replace(
+                    "permissions:\n  contents: read", replacement, 1
+                )
+                self.assertIn(
+                    "Rust CI token permissions must be exactly contents: read",
+                    verify_required_ci.contract_errors(broken),
+                )
+
+    def test_rust_ci_least_privilege_is_documented(self) -> None:
+        threat_model = Path("docs/security/threat-model.md").read_text(
+            encoding="utf-8"
+        )
+        self.assertIn("permissions:\n  contents: read", self.workflow)
+        self.assertIn(
+            "`rust-ci.yml` limits mutable pull-request jobs to `contents: read`",
+            threat_model,
+        )
+
     def test_missing_mandatory_dependency_is_rejected(self) -> None:
         broken = self.workflow.replace("        workspace,\n", "", 1)
         self.assertIn(

.github/scripts/verify_required_ci.py

@@ -17,6 +17,20 @@
 )
 
 
+def _top_level_permissions(workflow: str) -> set[tuple[str, str]]:
+    permissions_match = re.search(
+        r"(?ms)^permissions:\s*\n((?:^[ \t]+.*\n?)+)", workflow
+    )
+    if permissions_match is None:
+        return set()
+    return set(
+        re.findall(
+            r"(?m)^\s+([a-z-]+):\s*(read|write|none)\s*(?:#.*)?$",
+            permissions_match.group(1),
+        )
+    )
+
+
 def _job_block(workflow: str, job: str) -> str:
     match = re.search(
         rf"(?ms)^  {re.escape(job)}:\s*\n(.*?)(?=^  [A-Za-z0-9_-]+:\s*\n|\Z)",
@@ -29,17 +43,20 @@ def _job_block(workflow: str, job: str) -> str:
 
 def contract_errors(workflow: str) -> list[str]:
     """Return violations of the required-check aggregation contract."""
+    errors: list[str] = []
+    if _top_level_permissions(workflow) != {("contents", "read")}:
+        errors.append("Rust CI token permissions must be exactly contents: read")
+
     try:
         results = _job_block(workflow, "results")
     except ValueError as error:
-        return [str(error)]
+        return [*errors, str(error)]
 
     needs_match = re.search(r"(?ms)^    needs:\s*(.*?)(?=^    [A-Za-z0-9_-]+:|\Z)", results)
     if needs_match is None:
-        return ["results job has no needs dependency list"]
+        return [*errors, "results job has no needs dependency list"]
 
     needs = set(re.findall(r"\b[A-Za-z][A-Za-z0-9_]*\b", needs_match.group(1)))
-    errors: list[str] = []
     for job in (*REQUIRED_JOBS, *CONDITIONAL_JOBS):
         if job not in needs:
             errors.append(f"results job does not depend on {job}")
@@ -57,20 +74,7 @@ def contract_errors(workflow: str) -> list[str]:
 def npm_contract_errors(workflow: str) -> list[str]:
     """Return violations that can hide an npm staging failure or lock drift."""
     errors: list[str] = []
-    permissions_match = re.search(
-        r"(?ms)^permissions:\s*\n((?:^[ \t]+.*\n?)+)", workflow
-    )
-    declared_permissions = (
-        set(
-            re.findall(
-                r"(?m)^\s+([a-z-]+):\s*(read|write|none)\s*(?:#.*)?$",
-                permissions_match.group(1),
-            )
-        )
-        if permissions_match is not None
-        else set()
-    )
-    if declared_permissions != {("contents", "read")}:
+    if _top_level_permissions(workflow) != {("contents", "read")}:
         errors.append("npm CI token permissions must be exactly contents: read")
 
     if "pnpm install --frozen-lockfile" not in workflow:

.github/workflows/rust-ci.yml

@@ -8,6 +8,9 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

docs/security/threat-model.md

@@ -92,11 +92,11 @@ S7-3 adds the 90-day CI gate.
 | Threat | Rating | Specific attack vector | Mitigation | Owner | Last reviewed |
 |--------|--------|------------------------|------------|-------|---------------|
 | **S — Spoofing** | med | Compromised third-party GitHub Action runs attacker code in CI | Critical actions in `.github/workflows/ci.yml` are commit-pinned; repository-wide pin coverage remains a review item rather than an assumed invariant | ci-ops | 2026-07-18 |
-| **T — Tampering** | high | A pull request changes staging code and exfiltrates a cross-repository release credential | Pull-request staging executes the checked-out PR merge ref. Never expose an upstream PAT or GitHub App key directly to this mutable job; move authenticated staging behind a trusted workflow boundary first | ci-ops | 2026-07-18 |
+| **T — Tampering** | high | A pull request changes staging or build code and abuses the workflow token | Pull-request staging executes the checked-out PR merge ref. Never expose an upstream PAT or GitHub App key directly to this mutable job; move authenticated staging behind a trusted workflow boundary first. `rust-ci.yml` limits mutable pull-request jobs to `contents: read` | ci-ops | 2026-07-18 |
 | **R — Repudiation** | low | Workflow authorship or the artifact source is ambiguous | Git commit and Actions run logs identify the executed revision; staging must additionally retain upstream run, artifact ID, and digest evidence | ci-ops | 2026-07-18 |
 | **I — Info disclosure** | high | Workflow logs or PR-controlled code leak a release credential | `.github/workflows/ci.yml` grants its repository-scoped `github.token` only `contents: read`; no upstream `Actions: read` credential is configured. This keeps the credential boundary closed but leaves staging proper red | security | 2026-07-18 |
 | **D — DoS** | med | PRs trigger expensive multi-platform jobs or downloads of stale artifacts | The npm workflow has a concurrency group and ten-minute timeout. Current CI also uses macOS and Windows runners, so runner cost is not Linux-only | infra | 2026-07-18 |
-| **E — Elevation** | high | A workflow inherits broad repository permissions or a compromised cross-repository token | Repository workflow permissions currently default to `write`; 6 of 26 workflow files now declare a top-level `permissions:` block, including `ci.yml` with only `contents: read`. The built-in token remains limited to this repository and cannot authorize upstream artifact downloads | ci-ops | 2026-07-18 |
+| **E — Elevation** | high | A workflow inherits broad repository permissions or a compromised cross-repository token | Repository workflow permissions currently default to `write`; 7 of 26 workflow files now declare a top-level `permissions:` block, including `ci.yml` and `rust-ci.yml` with only `contents: read`. The built-in token remains limited to this repository and cannot authorize upstream artifact downloads | ci-ops | 2026-07-18 |
 
 ### npm staging boundary (PR #605)