ci: restrict Bazel workflow token permissions

Author: KooshaPari

.github/scripts/test_verify_required_ci.py

@@ -26,6 +26,9 @@ def setUpClass(cls) -> None:
         cls.blob_size_policy_workflow = Path(
             ".github/workflows/blob-size-policy.yml"
         ).read_text(encoding="utf-8")
+        cls.bazel_workflow = Path(".github/workflows/bazel.yml").read_text(
+            encoding="utf-8"
+        )
         cls.python_runtime_build_workflow = Path(
             ".github/workflows/python-runtime-build.yml"
         ).read_text(encoding="utf-8")
@@ -161,6 +164,38 @@ def test_blob_size_policy_broader_permissions_are_rejected(self) -> None:
             verify_required_ci.blob_size_policy_contract_errors(broken),
         )
 
+    def test_bazel_permissions_are_least_privilege(self) -> None:
+        self.assertEqual([], verify_required_ci.bazel_contract_errors(self.bazel_workflow))
+
+    def test_missing_bazel_token_permissions_are_rejected(self) -> None:
+        broken = self.bazel_workflow.replace(
+            "permissions:\n    contents: read\n\n", "", 1
+        )
+        self.assertIn(
+            "Bazel CI token permissions must be exactly contents: read",
+            verify_required_ci.bazel_contract_errors(broken),
+        )
+
+    def test_broader_bazel_token_permissions_are_rejected(self) -> None:
+        broken = self.bazel_workflow.replace(
+            "permissions:\n    contents: read",
+            "permissions:\n    contents: read\n    actions: write",
+            1,
+        )
+        self.assertIn(
+            "Bazel CI token permissions must be exactly contents: read",
+            verify_required_ci.bazel_contract_errors(broken),
+        )
+
+    def test_nested_bazel_token_permissions_are_rejected(self) -> None:
+        broken = self.bazel_workflow.replace(
+            "permissions:\n    contents: read\n\n", "", 1
+        ).replace("    test:\n", "    test:\n        permissions:\n            contents: read\n", 1)
+        self.assertIn(
+            "Bazel CI token permissions must be exactly contents: read",
+            verify_required_ci.bazel_contract_errors(broken),
+        )
+
     def test_blob_size_policy_least_privilege_is_documented(self) -> None:
         threat_model = Path("docs/security/threat-model.md").read_text(encoding="utf-8")
         self.assertIn(

.github/scripts/verify_required_ci.py

@@ -124,6 +124,13 @@ def blob_size_policy_contract_errors(workflow: str) -> list[str]:
     return []
 
 
+def bazel_contract_errors(workflow: str) -> list[str]:
+    """Return violations of the Bazel CI least-privilege token contract."""
+    if _top_level_permissions(workflow) != {("contents", "read")}:
+        return ["Bazel CI token permissions must be exactly contents: read"]
+    return []
+
+
 def python_runtime_build_contract_errors(workflow: str) -> list[str]:
     """Return violations of the Python runtime build token contract."""
     if _top_level_permissions(workflow) != {("contents", "read")}:
@@ -195,6 +202,11 @@ def main() -> int:
         type=Path,
         default=Path(".github/workflows/blob-size-policy.yml"),
     )
+    parser.add_argument(
+        "--bazel-workflow",
+        type=Path,
+        default=Path(".github/workflows/bazel.yml"),
+    )
     parser.add_argument(
         "--python-runtime-build-workflow",
         type=Path,
@@ -227,6 +239,7 @@ def main() -> int:
             args.blob_size_policy_workflow.read_text(encoding="utf-8")
         )
     )
+    errors.extend(bazel_contract_errors(args.bazel_workflow.read_text(encoding="utf-8")))
     errors.extend(
         python_runtime_build_contract_errors(
             args.python_runtime_build_workflow.read_text(encoding="utf-8")

.github/workflows/bazel.yml

@@ -16,6 +16,10 @@ concurrency:
     group: concurrency-group::${{ github.workflow }}::${{ github.event.pull_request.number > 0 && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}${{ github.ref_name == 'main' && format('::{0}', github.run_id) || ''}}
     cancel-in-progress: ${{ github.ref_name != 'main' }}
 
+# Bazel CI only reads the repository and uploads non-fatal build diagnostics.
+permissions:
+    contents: read
+
 jobs:
     test:
         # PRs use the sharded Windows cross-compiled test jobs below. Post-merge

docs/security/threat-model.md

@@ -96,7 +96,7 @@ S7-3 adds the 90-day CI gate.
 | **R — Repudiation**     | low    | Workflow authorship or the artifact source is ambiguous                                  | Git commit and Actions run logs identify the executed revision; the pinned release fallback verifies GitHub's published SHA-256 digest and embedded package identity for every npm asset                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    | ci-ops   | 2026-07-18    |
 | **I — Info disclosure** | high   | Workflow logs or PR-controlled code leak a release credential                            | `.github/workflows/ci.yml` grants its repository-scoped `github.token` only `contents: read`. Its release fallback downloads exact public URLs with no token or secret                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | security | 2026-07-18    |
 | **D — DoS**             | med    | PRs trigger expensive multi-platform jobs or downloads of stale artifacts                | The npm workflow has a concurrency group and ten-minute timeout. Current CI also uses macOS and Windows runners, so runner cost is not Linux-only                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | infra    | 2026-07-18    |
-| **E — Elevation**       | high   | A workflow inherits broad repository permissions or a compromised cross-repository token | Repository workflow permissions currently default to `write`; 14 of 26 workflow files now declare a top-level `permissions:` block, including `ci.yml`, `rust-ci.yml`, `rust-ci-full.yml`, `rust-ci-full-nextest-platform.yml`, `sdk.yml`, `blob-size-policy.yml`, `python-runtime-build.yml`, `v8-canary.yml`, and `trufflehog.yml` with only `contents: read`. The built-in token remains limited to this repository and cannot authorize upstream artifact downloads                                                                                                                                                                                                                                                                                                                     | ci-ops   | 2026-07-18    |
+| **E — Elevation**       | high   | A workflow inherits broad repository permissions or a compromised cross-repository token | Repository workflow permissions currently default to `write`; 15 of 26 workflow files now declare a top-level `permissions:` block, including `ci.yml`, `rust-ci.yml`, `rust-ci-full.yml`, `rust-ci-full-nextest-platform.yml`, `sdk.yml`, `blob-size-policy.yml`, `bazel.yml`, `python-runtime-build.yml`, `v8-canary.yml`, and `trufflehog.yml` with only `contents: read`. The built-in token remains limited to this repository and cannot authorize upstream artifact downloads                                                                                                                                                                                                                                                                                                                     | ci-ops   | 2026-07-18    |
 
 ### npm staging boundary (PR #605)