From b8e5486f63e1a1901385695a5ce7a52a5c9d7797 Mon Sep 17 00:00:00 2001
From: Vincent Koc <vincentkoc@ieee.org>
Date: Thu, 7 May 2026 01:13:54 -0700
Subject: [PATCH] chore(ci): harden security ownership and workflow permissions
 (#2045)

* chore(security): expand protected automation owners

* chore(ci): default workflows to no token permissions
---
 .github/CODEOWNERS                            | 3 +++
 .github/workflows/clawhub-cli-npm-release.yml | 2 ++
 .github/workflows/package-publish.yml         | 2 ++
 .github/workflows/secret-scan.yml             | 2 ++
 .github/workflows/update-convex-ai-files.yml  | 2 ++
 5 files changed, 11 insertions(+)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index eee7f603..8a07dc4a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -5,7 +5,10 @@
 # If you add overlapping rules below the secops block, include @openclaw/openclaw-secops
 # on those entries too or you can silently remove required secops review.
 # Security-sensitive code, config, workflows, and docs require secops review.
+/.github/actions/ @openclaw/openclaw-secops
+/.github/actionlint.yaml @openclaw/openclaw-secops
 /.github/codeql/ @openclaw/openclaw-secops
+/.github/dependabot.yml @openclaw/openclaw-secops
 /.github/workflows/ @openclaw/openclaw-secops
 /scripts/check-staged-secrets.mjs @openclaw/openclaw-secops
 /scripts/clawhub-cli-npm-publish.sh @openclaw/openclaw-secops
diff --git a/.github/workflows/clawhub-cli-npm-release.yml b/.github/workflows/clawhub-cli-npm-release.yml
index 79253401..d7d358fb 100644
--- a/.github/workflows/clawhub-cli-npm-release.yml
+++ b/.github/workflows/clawhub-cli-npm-release.yml
@@ -21,6 +21,8 @@ concurrency:
   group: clawhub-cli-npm-release-${{ inputs.tag }}
   cancel-in-progress: false
 
+permissions: {}
+
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   NODE_VERSION: "24.x"
diff --git a/.github/workflows/package-publish.yml b/.github/workflows/package-publish.yml
index ad92bb2d..901f395c 100644
--- a/.github/workflows/package-publish.yml
+++ b/.github/workflows/package-publish.yml
@@ -80,6 +80,8 @@ on:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+permissions: {}
+
 jobs:
   publish:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index 21674809..659db050 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -6,6 +6,8 @@ on:
   pull_request:
     branches: [main, master]
 
+permissions: {}
+
 jobs:
   trufflehog:
     name: Scan for Verified Secrets
diff --git a/.github/workflows/update-convex-ai-files.yml b/.github/workflows/update-convex-ai-files.yml
index face4cd0..b72d1a2d 100644
--- a/.github/workflows/update-convex-ai-files.yml
+++ b/.github/workflows/update-convex-ai-files.yml
@@ -10,6 +10,8 @@ concurrency:
   group: update-convex-ai-files
   cancel-in-progress: false
 
+permissions: {}
+
 env:
   BUN_VERSION: "1.3.10"
   UPDATE_BRANCH: automation/update-convex-ai-files