PDP-1182 SECCMP-1797: Downgrade contents permission from write to read in pr-workflow

[GAdityaVarma]

SECCMP-1797: Downgrade contents permission from write to read

Problem

The copyright-validation job grants contents: write to the workflow token. This is unnecessary - the called reusable workflow (copyright-check.yml) only needs contents: read to checkout code and already declares that in its own permissions block.

Granting contents: write in a pull_request_target workflow expands the blast radius of any PwnRequest-style attack by giving the token ability to push commits, create tags, or modify repo contents.

Fix

# Before
permissions:
  contents: write     # unnecessary
  pull-requests: write
  issues: write

# After
permissions:
  contents: read      # least privilege
  pull-requests: write
  issues: write

References

• SECCMP-1797

[Copilot]

Pull request overview

Reduces the GitHub Actions token permissions for the copyright-validation job in the PR workflow to follow least-privilege guidance for pull_request_target workflows.

Changes:

• Downgrade contents permission from write to read for the copyright-validation job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

The base branch was changed.