fix: add explicit empty permissions to docs-broken-links workflow

[msukkari]

Summary

This PR addresses CodeQL security alert #1 (actions/missing-workflow-permissions) by adding explicit permissions: {} to the docs-broken-links.yml workflow.

Problem

The workflow runs a broken-link check job using Mintlify without declaring explicit GitHub token permissions. Without explicit permissions, the job inherits default token permissions (potentially contents: write or pull-requests: write depending on repo settings).

Since this workflow:

• Checks out the repository
• Installs the Mintlify CLI via npm
• Runs mintlify broken-links in the docs directory

None of these steps require any GitHub token access, yet the ambient GITHUB_TOKEN could be exploited if the Mintlify package were compromised.

Solution

Add permissions: {} at the workflow level to explicitly deny all GitHub token permissions, following the principle of least privilege.

References

• GitHub Alert #1
• CodeQL rule: actions/missing-workflow-permissions
• GitHub Docs: Permissions for the GITHUB_TOKEN

Fixes #932

Linear Issue: SOU-932

  

Summary by CodeRabbit

• Bug Fixes

  • Corrected the documentation workflow's permissions to enforce least-privilege and prevent unintended token access.

• Documentation

  • Added a changelog entry noting the workflow permissions fix.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 00a4ea7a-a82b-41af-a5e9-e4d224afce04

📥 Commits

Reviewing files that changed from the base of the PR and between b1aad96 and 1401a1c.

📒 Files selected for processing (1)

• CHANGELOG.md

✅ Files skipped from review due to trivial changes (1)

• CHANGELOG.md

---

Walkthrough

This PR adds an explicit workflow-level permissions: {} block to .github/workflows/docs-broken-links.yml and records the change in CHANGELOG.md. No other workflow behavior, triggers, or job steps were modified.

Changes

Cohort / File(s)	Summary
GitHub Actions Configuration ​.github/workflows/docs-broken-links.yml	Added a top-level permissions: {} block to explicitly set no GitHub token permissions for the workflow.
Changelog CHANGELOG.md	Added an Unreleased → Fixed entry documenting the addition of explicit workflow permissions to docs-broken-links.yml.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Suggested reviewers

• brendan-kellam

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR addresses security (adding workflow permissions) but linked issue #932 requires preserving angle-bracketed text in chat. No code changes related to #932 are present in this PR.	Either relink to the correct issue (#1131 or similar security-focused issue) or include code changes that address the angle-bracketed text preservation in chat as described in #932.
Out of Scope Changes check	⚠️ Warning	All changes are in-scope for adding workflow permissions: .github/workflows/docs-broken-links.yml and CHANGELOG.md updates. However, the security fix appears unrelated to the linked issue #932 about chat rendering.	The workflow permissions fix is out-of-scope relative to linked issue #932. Update the issue links to reference the actual security issue this PR addresses.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title accurately describes the main change: adding explicit empty permissions to the docs-broken-links workflow to address security concerns.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/fix-workflow-permissions-e99b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}