Backport workflow-hardening fix (excessive-permissions) to 5 release branches

[CharlieMCY]

Summary

The default branch already hardened .github/workflows/cluster_recreate.yml against the issue(s) below, but 5 release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

What's flagged (by zizmor)

• excessive-permissions — workflow/job granted broader permissions than needed

Already resolved on the default branch in:

• 9bb37aa

Affected release branches (5)

• release/v1.0 (still present as of HEAD 0825594f)
• release/v0.5 (still present as of HEAD 11f61474)
• release/v0.9 (still present as of HEAD 6d3c4a42)
• release/v0.8 (still present as of HEAD 7a5242ec)
• release/v0.7 (still present as of HEAD bb778a76)

Suggested per-branch patches

Each diff below was checked locally with zizmor and actionlint: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release/v1.0 — excessive-permissions

File .github/workflows/cluster_recreate.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'

--- a/.github/workflows/cluster_recreate.yml
+++ b/.github/workflows/cluster_recreate.yml
@@ -43,3 +43,5 @@
           fifoUUID=$(curl -fsSL "http://$SYNC_IP:8080/fifo/new" | jq -r '.uuid')
           echo "Fifo UUID: $fifoUUID"
           kubectl create configmap sync-server-fifo "--from-literal=uuid=$fifoUUID"
+    permissions:
+      contents: read

release/v0.5 — excessive-permissions

File .github/workflows/cluster_recreate.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'

--- a/.github/workflows/cluster_recreate.yml
+++ b/.github/workflows/cluster_recreate.yml
@@ -29,3 +29,5 @@
       - name: Create CI cluster
         run: |
           nix run .#scripts.create-coco-aks -- --name="$azure_resource_group"
+    permissions:
+      contents: read

release/v0.9 — excessive-permissions

File .github/workflows/cluster_recreate.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'

--- a/.github/workflows/cluster_recreate.yml
+++ b/.github/workflows/cluster_recreate.yml
@@ -43,3 +43,5 @@
           fifoUUID=$(curl -fsSL "http://$SYNC_IP:8080/fifo/new" | jq -r '.uuid')
           echo "Fifo UUID: $fifoUUID"
           kubectl create configmap sync-server-fifo "--from-literal=uuid=$fifoUUID"
+    permissions:
+      contents: read

release/v0.8 — excessive-permissions

File .github/workflows/cluster_recreate.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'

--- a/.github/workflows/cluster_recreate.yml
+++ b/.github/workflows/cluster_recreate.yml
@@ -43,3 +43,5 @@
           fifoUUID=$(curl -fsSL http://$SYNC_IP:8080/fifo/new | jq -r '.uuid')
           echo "Fifo UUID: $fifoUUID"
           kubectl create configmap sync-server-fifo --from-literal=uuid=$fifoUUID
+    permissions:
+      contents: read

release/v0.7 — excessive-permissions

File .github/workflows/cluster_recreate.yml; suggested edits:

• • jobs.$J.permissions.contents = 'read'

--- a/.github/workflows/cluster_recreate.yml
+++ b/.github/workflows/cluster_recreate.yml
@@ -43,3 +43,5 @@
           fifoUUID=$(curl -fsSL http://$SYNC_IP:8080/fifo/new | jq -r '.uuid')
           echo "Fifo UUID: $fifoUUID"
           kubectl create configmap sync-server-fifo --from-literal=uuid=$fifoUUID
+    permissions:
+      contents: read

---

Happy to open pull requests instead if that's preferred.