sec(mint-scope): the weekly backstop drops contents:write across the fleet

[LukasWodka]

What

kanban-reconcile.yml was minting the App's entire permission set — including contents: write across every repo the installation covers — to run the weekly board backstop.

Narrowed, not made read-only

This one genuinely writes, and I checked rather than assuming:

• three ProjectV2 mutations (addProjectV2ItemById, updateProjectV2ItemFieldValue, archiveProjectV2Item)
• it creates labels — POST repos/{o}/{r}/labels for keep-open and sibling-merge
• and applies them — POST repos/{o}/{r}/issues/{n}/labels

Claiming it read-only would break the Monday run.

The win is contents

	before	after
contents	write	read
issues	write	write (labels)
pull-requests	write	write (labels on PRs)
organization-projects	write	write (board)
administration / actions / checks	read	gone

contents: write is the capability that can push code to any repo. This job's only content access is reading.github/workflows/add-to-kanban.yml and a couple of branch refs.

pull-requests: write is retained because the labels land on PRs as well as issues and the endpoint is shared. Guessing it short would fail on a path that only runs weekly — so it stays until measured, rather than assumed away.

This is the one that is provable without a hop

.github's default branch is develop, crons run from the default branch, and this workflow has a dry-run dispatch input. So once this merges:

gh workflow run kanban-reconcile.yml --repo tracebloc/.github -f dry-run=true

exercises the real mint and every read path with no mutation. That is why this went ahead of standards-sync: it is the only one of the four where the evidence that matters — the token actually working — is obtainable the same day rather than after develop → staging → main.

It also directly answers the trap release-train/add-to-kanban.yml records:

a mint can succeed with a scope the board write then needs and lacks, and that is the one path nothing here has exercised

A dry run proves the reads. The writes are still only proven by the first real Monday run — I'm not going to claim otherwise.

Not closing the ticket

Three of four. Remaining: standards-sync.yml, which is report-only on schedule/push/issues/pull_request but mints Contents: RW for the create-prs dispatch mode. That is the largest mismatch left and the one whose risky mode cannot be rehearsed without opening 19 real PRs — it deserves its own decision, not a batch slot.

Test plan

• make lint — clean
• make selftests — 28 passed, 0 failed
• actionlint — clean
• make mint-scope — 3 unscoped / 3 exempted / 0 findings
• Live, after merge:dry-run=true dispatch (reads + mint). Writes confirmed by the first scheduled run.

Part of tracebloc/backend#2157

---

Note

Medium Risk
Changes least-privilege on a workflow that still writes labels and board state weekly; a wrong scope would fail the Monday reconcile rather than at merge time, though dry-run can validate reads after merge.

Overview
Narrows the weekly kanban-reconcile GitHub App installation token from the App’s full grant to explicit permission-* inputs on actions/create-github-app-token.

The main reduction is contents: write → contents: read, since the job only reads workflow files and branch refs while still needing issues / pull-requests write for label create/apply and organization-projects write for ProjectV2 mutations. administration / actions / checks read are no longer requested.

Updatesscripts/mint-scope.py to remove kanban-reconcile.yml from EXEMPT and refresh the burn-down notes so only fr-gate.yml and standards-sync.yml remain exempt from the explicit-scope guard.

^{Reviewed by Cursor Bugbot for commit 5e01b15. Bugbot is set up for automated code reviews on this repo. Configure here.}

[saadqbal]

The right call is the one you didn't make — claiming this read-only would have broken the Monday run, and you checked instead: three ProjectV2 mutations, label creation, label application. Dropping contents to read while keeping the three writes it actually uses is the real win, since contents:write is the one that can push code to any repo in the installation.

Keeping pull-requests: write unmeasured-but-retained is also right — guessing it short would fail on a path that only runs weekly. 👍