fix(permissions-guard): require all jobs in read-only workflows to declare read permissions (closes #581)

[d-morrison]

Closes #581

⚠️ Stacked on #596 — merge that first.

Depends on: #596

WIP — opened up front to claim the issue; implementing now.

---

Note

Medium Risk
Tightens GHA token-permission classification so undeclared jobs no longer look read-only; a bug here could mis-document caller grants. Workflow jobs only add empty permissions: {} on assert-only gates.

Overview
Fixes gha#581: run-permissions-docs-tests no longer treats a reusable workflow as read-only just because some jobs declare read permissions. Jobs without a permissions: block now inherit the workflow-level map, or are treated as not read-only if that is also missing (caller token could include write).

Adds permissions: {} on the require-review jobs in Claude, Gemini, and OpenCode review workflows so those assert-only jobs do not inherit caller write tokens. Empty {} still counts as read-only.

Self-test covers a mixed declared/undeclared two-job workflow.

^{Reviewed by Cursor Bugbot for commit 914018f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[d-morrison]

@claude review

[github-actions]

👀 Picked up by workflow run #32678083484. Setup runs first; Claude itself responds after that.

[github-actions]

Caution

OpenCode review failed: the CLI exited 1 without completing the review.

A non-zero exit means the run did not complete (auth rejection, quota or
credits exhausted, transport failure). Check the raw output below and the
job log; do not retry blindly against an auth or credits failure.

Raw CLI output

�[0m
> plan · big-pickle
�[0m
�[0m→ �[0mRead .github/workflows/scripts/tests/run-permissions-docs-tests.py
�[0m✱ �[0mGrep "run-permissions-docs-tests"�[90m in . · 11 matches�[0m
�[0m✱ �[0mGrep "permissions: \{\}"�[90m in . · 0 matches�[0m
�[91m�[1mError: �[0mProvider finish_reason: network_error

View run

[github-actions]

Caution

OpenCode review failed: the CLI exited 1 without completing the review.

A non-zero exit means the run did not complete (auth rejection, quota or
credits exhausted, transport failure). Check the raw output below and the
job log; do not retry blindly against an auth or credits failure.

Raw CLI output

�[0m
> plan · big-pickle
�[0m
�[91m�[1mError: �[0mProvider finish_reason: network_error

View run

[github-actions]

Caution

OpenCode review failed: the CLI exited 1 without completing the review.

A non-zero exit means the run did not complete (auth rejection, quota or
credits exhausted, transport failure). Check the raw output below and the
job log; do not retry blindly against an auth or credits failure.

Raw CLI output

�[0m
> plan · big-pickle
�[0m
�[91m�[1mError: �[0mProvider finish_reason: network_error

View run

[dem-extra1]

bugbot run

[cursor]

Bugbot couldn't run — GitHub account mismatch

The GitHub account linked to your Cursor account does not match the PR author.

Please ensure you're using the correct GitHub account, or run Bugbot from a team that covers this repository.

[dem-extra1]

bugbot run

[cursor]

Bugbot couldn't run — GitHub account mismatch

The GitHub account linked to your Cursor account does not match the PR author.

Please ensure you're using the correct GitHub account, or run Bugbot from a team that covers this repository.

[d-morrison]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 914018f. Configure here.}

[dem-extra1]

@claude review

[dem-extra1]

/review

[github-actions]

👀 Picked up by workflow run #32699230668. Setup runs first; Claude itself responds after that.

[github-actions]

Warning

No review ran --- this PR edits .github/workflows/claude-code-review.yml.
claude-code-action requires workflow files to match the default branch on dispatched runs, so its token exchange fails until this change merges.
The review is skipped by design, and re-running or re-dispatching will not change that: the skip lifts only if the PR stops editing that file.

require-review reports a gray skipped rather than green.
A green there attests that a reviewer ran, never that one approved; here none ran at all.
Merge on a self-review or a human review instead.

View run