Workflows do not declare least-privilege GITHUB_TOKEN permissions

[z33b0t]

None of the four workflows declare a permissions: block, so GITHUB_TOKEN is issued with the repository default scope rather than the least privilege each job needs. CodeQL raised actions/missing-workflow-permissions on two of them:

• alert #2 — .github/workflows/server.yml:42
• alert #1 — .github/workflows/www.yml:28

It only flagged those two because mac.yml and windows.yml genuinely use the token — gh release create / gh release upload — so their wider scope looks intentional to the analysis. They are still relying on an implicit default rather than asking for what they need.

What each job actually uses:

workflow	needs	proposed
server.yml	checkout only	contents: read
www.yml	checkout; deploys with Cloudflare credentials, not GITHUB_TOKEN	contents: read
mac.yml	checkout + create/upload a Release	contents: write
windows.yml	checkout + create/upload a Release	contents: write

Adding a top-level permissions: block to each is the whole change. It clears both alerts and makes the two release workflows state the write access they depend on instead of inheriting it, so a later change to the repository default cannot silently widen or break them.

Note mac.yml also passes HOMEBREW_TAP_TOKEN to push the cask to lightware-dev/homebrew-tap. That is a separate PAT and unaffected by permissions:, which only scopes GITHUB_TOKEN.

Found by CodeQL after the repo went public.

[z33b0t]

From #25 (duplicate, now closed) — worth stating explicitly so this isn't triaged as urgent: the repository default is currently default_workflow_permissions: read with can_approve_pull_request_reviews: false, so there is no live exposure today.

The value of declaring permissions: locally is that the default is a repo-level setting held outside the codebase. Flipping it to read/write is one click, plausibly done for an unrelated reason, and would silently widen every workflow that declares nothing — with no diff to review and no PR to catch it. Declaring the floor in each workflow makes that change visible instead of ambient.