Add least-privilege permissions to GitHub Actions workflows

[peter-matkovski]

Goal

Add least-privilege permissions blocks to GitHub Actions workflows to resolve CodeQL actions/missing-workflow-permissions alerts (APPSEC-164).

Implementation

• Add explicit workflow-level permissions blocks across GitHub Actions workflows.
• Default to read-only scopes (contents: read, pull-requests: read).
• Grant write scopes only where jobs need them (artifacts, Danger, release git push).

Testing

• CI green on this PR
• Code scanning alerts close after merge

[coderabbitai]

Walkthrough

Nine GitHub Actions workflow files gain explicit permissions blocks scoping the GITHUB_TOKEN to specific read/write permissions for contents, actions, issues, and pull-requests. No job logic, triggers, or build/test steps were modified.

Changes

Workflow Permissions Hardening

Layer / File(s)	Summary
CI/build/test workflow permissions .github/workflows/android.yml, .github/workflows/app-distribute.yml, .github/workflows/e2e-build.yml, .github/workflows/e2e-test-cron.yml, .github/workflows/e2e-test.yml, .github/workflows/internal-app-distribute.yml	Adds top-level permissions blocks granting scoped combinations of contents: read, actions: write, and pull-requests: read.
Misc automation workflow permissions .github/workflows/no-response.yml, .github/workflows/publish-new-version.yml, .github/workflows/sdk-size-updates.yml	Adds permissions blocks granting contents: read, issues: write, and pull-requests: read as applicable.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Poem

Nine little workflows, locked up tight,
Tokens now scoped just right.
No more roaming wild and free,
Just read and write where it should be.
🐇 Hop, hop, ship it—CI's secure tonight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: adding least-privilege permissions to GitHub Actions workflows.
Description check	✅ Passed	The description includes the goal, implementation, and testing, which covers the main template requirements despite missing optional sections.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/workflow-least-privilege-permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/e2e-test-cron.yml (1)

21-24: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Scope actions: write to the artifact-uploading jobs
Keep contents: read at the workflow level, but move actions: write onto both build-compose-apks and run-compose-tests-nightly; slack doesn’t need it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/e2e-test-cron.yml around lines 21 - 24, The workflow
currently grants actions: write at the top level, but this permission should be
scoped only to the artifact-uploading jobs. Keep contents: read at the workflow
level, and move actions: write onto the build-compose-apks and
run-compose-tests-nightly jobs only; leave slack without that permission.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/e2e-build.yml:
- Around line 12-14: The workflow permissions are broader than needed because
the e2e-build job grants actions: write even though the referenced actions only
require read access. Update the permissions block in the e2e-build workflow to
remove the actions scope and keep only contents: read, so the job runs with
least privilege.

---

Nitpick comments:
In @.github/workflows/e2e-test-cron.yml:
- Around line 21-24: The workflow currently grants actions: write at the top
level, but this permission should be scoped only to the artifact-uploading jobs.
Keep contents: read at the workflow level, and move actions: write onto the
build-compose-apks and run-compose-tests-nightly jobs only; leave slack without
that permission.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: f5ed9698-6507-40eb-b5c1-31c763a16829

📥 Commits

Reviewing files that changed from the base of the PR and between 374d8c1 and 0ad2db7.

📒 Files selected for processing (9)

• .github/workflows/android.yml
• .github/workflows/app-distribute.yml
• .github/workflows/e2e-build.yml
• .github/workflows/e2e-test-cron.yml
• .github/workflows/e2e-test.yml
• .github/workflows/internal-app-distribute.yml
• .github/workflows/no-response.yml
• .github/workflows/publish-new-version.yml
• .github/workflows/sdk-size-updates.yml

[github-actions]

SDK Size Comparison 📏

SDK	Before	After	Difference	Status
stream-video-android-core	12.27 MB	12.27 MB	0.00 MB	🟢
stream-video-android-ui-xml	5.68 MB	5.68 MB	0.00 MB	🟢
stream-video-android-ui-compose	6.20 MB	6.20 MB	0.00 MB	🟢

[github-actions]

PR checklist ✅

All required conditions are satisfied:

• Title length is OK (or ignored by label).
• At least one pr: label exists.
• Sections ### Goal, ### Implementation, and ### Testing are filled, or the PR is bot-authored.
• An issue is linked (Linear ticket or GitHub issue), or the PR is bot-authored.

🎉 Great job! This PR is ready for review.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[stream-public-bot]

🚀 Available in v1.29.0