From 40cc068acd935e4abaa2f1e0cc6bea816678e2e1 Mon Sep 17 00:00:00 2001
From: highlander <highlander@keepkey.com>
Date: Tue, 25 Aug 2026 09:45:28 -0500
Subject: [PATCH] fix(ci): add explicit least-privilege permissions default

ci.yml declared no top-level `permissions:` block, so every job -- including
ones that just checkout, build, and run tests -- inherited whatever the
repo default GITHUB_TOKEN scope was, with no explicit floor. Only
publish-emulator-libs actually needs write access (gh release create/upload),
and it already declares its own contents:write override, which continues to
take precedence over this default.

Second half of #424 (the first half, unverified gitleaks install, was fixed
by #589).
---
 .github/workflows/ci.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 835f461e3..b4b4a1c19 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -48,6 +48,14 @@ env:
   BASE_IMAGE: kktech/firmware@sha256:7438e53933d47d53157ed6d96d864cb208597e62dce26235ace09d1063427fa2
   EMU_IMAGE: kkemu-ci
 
+# Least-privilege default: every job gets a read-only GITHUB_TOKEN unless it
+# declares its own `permissions:` override (publish-emulator-libs does, for
+# the `gh release` calls it needs `contents: write` for). Without this,
+# every job -- including ones that just checkout/build/test -- inherited
+# whatever the repo's default token scope was, with no explicit floor. #424.
+permissions:
+  contents: read
+
 jobs:
   # ═══════════════════════════════════════════════════════════
   # STAGE 1: GATE — kill bad PRs in seconds