From b1be2a0f85438c7e2905224195acc293e51dbfea Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 18:26:56 +0000
Subject: [PATCH] Harden serialization-compat workflow token scope

Add a top-level read-only permissions block and persist-credentials:
false on every checkout, so the GITHUB_TOKEN isn't exposed to the
pnpm install / tsx steps. The workflow only reads code and runs tests.

Co-Authored-By: Konstantin Wohlwend <n2d4xc@gmail.com>
---
 .github/workflows/bulldozer-serialization-compat.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/bulldozer-serialization-compat.yaml b/.github/workflows/bulldozer-serialization-compat.yaml
index 219487e4a..2c821d30d 100644
--- a/.github/workflows/bulldozer-serialization-compat.yaml
+++ b/.github/workflows/bulldozer-serialization-compat.yaml
@@ -13,6 +13,10 @@ on:
       - main
   pull_request:
 
+# This workflow only checks out code and runs tests; it never pushes or calls the GitHub API.
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/dev' }}
@@ -34,6 +38,7 @@ jobs:
       - name: Checkout current branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Check for serialization-relevant changes
@@ -68,11 +73,13 @@ jobs:
       - name: Checkout current branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
+          persist-credentials: false
           path: current
 
       - name: Checkout base branch (${{ needs.check-changed.outputs.base_branch }})
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
+          persist-credentials: false
           ref: ${{ needs.check-changed.outputs.base_branch }}
           path: base