Backport workflow-hardening fix (excessive-permissions) to 4 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/bazel.yml against the issue(s) below, but 4 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 18f5f28

Affected release branches (4)

• release-5.4.0 (still present as of HEAD b5da00ad)
• release-5.3.4 (still present as of HEAD 63d20eb9)
• release-5.3.3 (still present as of HEAD 29d90a4f)
• release-5.3.2 (still present as of HEAD 2baaf044)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-5.4.0 — excessive-permissions

File .github/workflows/bazel.yml; suggested edits:

• • permissions.actions = 'write'

--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -21,3 +21,5 @@
         run: bazel build --config=remote //...
       - name: Run Tests
         run: bazel test --config=remote //...
+permissions:
+  actions: write

release-5.3.4 — excessive-permissions

File .github/workflows/bazel.yml; suggested edits:

• • permissions.actions = 'write'

--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -21,3 +21,5 @@
         run: bazel build --config=remote //...
       - name: Run Tests
         run: bazel test --config=remote //...
+permissions:
+  actions: write

release-5.3.3 — excessive-permissions

File .github/workflows/bazel.yml; suggested edits:

• • permissions.actions = 'write'

--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -21,3 +21,5 @@
         run: bazel build --config=remote //...
       - name: Run Tests
         run: bazel test --config=remote //...
+permissions:
+  actions: write

release-5.3.2 — excessive-permissions

File .github/workflows/bazel.yml; suggested edits:

• • permissions.actions = 'write'

--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -21,3 +21,5 @@
         run: bazel build --config=remote //...
       - name: Run Tests
         run: bazel test --config=remote //...
+permissions:
+  actions: write

---

Happy to open pull requests instead if that's preferred.

[RockteMQ-AI]

Issue Evaluation

Category: CI/workflow | Status: Evaluated — Needs Maintainer Decision

Thanks for raising this. I verified the current state of the workflow files across all mentioned branches.

Findings:

1. Release branches confirmed: All 4 release branches (release-5.4.0, release-5.3.4, release-5.3.3, release-5.3.2) do lack explicit permissions in .github/workflows/bazel.yml, meaning they use GitHub's default broad token permissions.

2. Default branch also lacks it: The develop branch currently does not have permissions: actions: write either. The referenced commit 18f5f28a ("Set specific permissions to trigger the retry mechanism") added it in Aug 2024, but commit a8dde862 ("Enhance unit test retry mechanism", Sep 2024) later removed it when the retry logic was moved to the separate rerun-workflow.yml workflow.

3. Security context: For pull_request triggers, GitHub automatically restricts GITHUB_TOKEN permissions. For push triggers (which bazel.yml also listens to on master/develop/bazel branches), the token gets broader permissions. Adding explicit permissions: actions: write is a valid hardening practice.

Suggested approach:

• If the project wants to harden workflow permissions, the fix should first be applied to develop (since it's also missing there), then backported to the release branches.
• Consider also adding permissions to maven.yaml and rerun-workflow.yml on the release branches for consistency with commit 18f5f28a's original scope.

Flagging for maintainer review on whether to proceed with this hardening across all branches.

---

Automated evaluation by github-manager-bot