Fix actions/missing-workflow-permissions CodeQL alerts #137

Overview

This issue tracks the remediation of actions/missing-workflow-permissions CodeQL alerts detected in GitHub Actions workflows.

Details

• Rule: actions/missing-workflow-permissions
• Tool: CodeQL
• Severity: Medium 🟡
• SLA Deadline: 2026-12-28 (90 days from detection)
• Alert Count: 2 instances

What needs to be done

Review and fix the GitHub Actions workflow files that have missing permission declarations. This typically involves:

• Identifying workflow files with insufficient or missing permissions configuration
• Adding explicit permission declarations following the principle of least privilege
• Ensuring workflows have only the permissions they actually need
• Verifying the fixes with CodeQL scans

Links

• Parent Issue: 🔒 [IBM OSPO Security Notification] — IBM/ACE-RISCV #136 (IBM OSPO Security Notification)