task: Scorecard — harden GitHub Actions token permissions (Token-Permissions)

[mirzakopic]

Description

OpenSSF Scorecard reports Token-Permissions: 0/10 on nearly every public repo in the platform-mesh org. Most workflows declare contents: write and/or packages: write at the top level (workflow scope) instead of restricting them to the specific job that needs them. This violates the principle of least privilege for the GITHUB_TOKEN and is a high-impact, low-effort fix.

Fix pattern:

• Set top-level permissions: read-all (or omit and rely on default-read).
• Add permissions: blocks at the job level only for the steps that need write (image push, release commit, label apply, etc.).
• Reference: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token

Affected repos

Each box represents one repo to fix. Open the per-repo Scorecard for the exact workflow files and line numbers:
https://api.securityscorecards.dev/projects/github.com/platform-mesh/<repo> → look at the Token-Permissions check details.

• account-operator — https://api.securityscorecards.dev/projects/github.com/platform-mesh/account-operator
• extension-manager-operator — https://api.securityscorecards.dev/projects/github.com/platform-mesh/extension-manager-operator
• golang-commons — https://api.securityscorecards.dev/projects/github.com/platform-mesh/golang-commons
• helm-charts — https://api.securityscorecards.dev/projects/github.com/platform-mesh/helm-charts
• iam-service — https://api.securityscorecards.dev/projects/github.com/platform-mesh/iam-service
• iam-ui — https://api.securityscorecards.dev/projects/github.com/platform-mesh/iam-ui
• kubernetes-graphql-gateway — https://api.securityscorecards.dev/projects/github.com/platform-mesh/kubernetes-graphql-gateway
• ocm — https://api.securityscorecards.dev/projects/github.com/platform-mesh/ocm
• platform-mesh-operator — https://api.securityscorecards.dev/projects/github.com/platform-mesh/platform-mesh-operator
• platform-mesh.github.io — https://api.securityscorecards.dev/projects/github.com/platform-mesh/platform-mesh.github.io
• portal-server-lib — https://api.securityscorecards.dev/projects/github.com/platform-mesh/portal-server-lib
• portal-ui-lib — https://api.securityscorecards.dev/projects/github.com/platform-mesh/portal-ui-lib
• portal — https://api.securityscorecards.dev/projects/github.com/platform-mesh/portal
• provider-quickstart — https://api.securityscorecards.dev/projects/github.com/platform-mesh/provider-quickstart
• rebac-authz-webhook — https://api.securityscorecards.dev/projects/github.com/platform-mesh/rebac-authz-webhook
• security-operator — https://api.securityscorecards.dev/projects/github.com/platform-mesh/security-operator
• subroutines — https://api.securityscorecards.dev/projects/github.com/platform-mesh/subroutines
• upstream-images — https://api.securityscorecards.dev/projects/github.com/platform-mesh/upstream-images
• virtual-workspaces — https://api.securityscorecards.dev/projects/github.com/platform-mesh/virtual-workspaces

Objectives

• All public repos with workflows score Token-Permissions: 9/10 or 10/10.
• Top-level permissions: read-all becomes the default for new workflows added to platform-mesh repos (consider documenting in .github repo).

Demo Required

None

Demo Steps

No response

---

Epic: #278