ci: harden SCIP workflow permissions

[grtninja]

Summary

• pin actions/checkout in .github/workflows/scip.yml to an immutable commit SHA
• add explicit minimal permissions for the workflow token

Why

This keeps the existing SCIP upload flow intact while making the workflow a little
safer and more explicit:

• the checkout action no longer floats on a tag
• the workflow token is limited to contents: read
• the change stays one-file and behavior-preserving

Related public lane: this follows the same workflow-hardening pattern as
NousResearch/hermes-agent#7646 and Aider-AI/aider#5021.

Validation

• YAML parse of .github/workflows/scip.yml
• git diff --check

No Go source files or runtime code paths were changed in this patch.

[grtninja]

Current-head coordination packet — 2026-08-08T22:00:38Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN / ready / mergeable=true; changed files=1
• Checks/workflows observed at this head: no status/workflow result exposed by the current connector surface
• Review state: 0 reviews / 0 review threads / 0 current unresolved
• Contributor guidance recheck: CONTRIBUTING.md
• Exact-surface overlap: none detected among this open-PR union
• Owner next bounded action: Owner: re-read the exact current head/diff, run the narrowest relevant validation, and keep maintainer/review follow-up moving without duplicate bot triggers.
• Bot/review policy: no duplicate bot trigger and no human maintainer nudge; re-read this exact head/diff before any review reply.

This is a public-safe coordination receipt only. No push, merge, publication, credential, runtime, model, GPU, auth, or protected-reasoning mutation was performed or authorized by this pass.

[grtninja]

Current-head coordination packet — 2026-08-09T04:01:16Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN / ready / mergeable=true; changed files=1
• Checks/workflows observed at this head: no status/workflow result exposed by the current connector surface
• Review state: 0 reviews / 0 review threads / 0 current unresolved
• Contributor guidance recheck: CONTRIBUTING.md
• Exact-surface overlap: none detected among this open-PR union
• Owner next bounded action: Owner: re-read the exact current head/diff, run the narrowest relevant validation, and keep maintainer/review follow-up moving without duplicate bot triggers.
• Bot/review policy: no duplicate bot trigger and no human maintainer nudge; re-read this exact head/diff before any review reply.

This is a public-safe coordination receipt only. No push, merge, publication, credential, runtime, model, GPU, auth, or protected-reasoning mutation was performed or authorized by this pass.

[grtninja]

Current-head coordination packet — 2026-08-09T10:00:48Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN / ready / mergeable=true; changed files=1
• Checks/workflows observed at this head: none reported
• Review state: 0 reviews / 0 review threads / 0 current unresolved
• Current unresolved paths: none
• Contributor guidance recheck: CONTRIBUTING.md
• Exact-surface overlap: none detected among this open-PR union
• Owner next bounded action: Owner: re-read the exact current head/diff, run the narrowest relevant validation, and keep maintainer/review follow-up moving without duplicate bot triggers.
• Bot/review policy: no duplicate bot trigger and no human maintainer-review nudge; re-read current head/diff before any reply.
• Coordination boundary: public-safe packet only; no push, merge, publish, protected model/reasoning mutation, or process restart in this pass.

[grtninja]

Current-head coordination packet — 2026-08-09T16:01:56Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN / ready / mergeable=true; observed merge-state=see live inventory; changed files=1
• Checks/workflows at this head: none reported
• Review state: 0 reviews (latest none) / 0 review threads / 0 current unresolved
• Current unresolved paths: none
• Contributor guidance recheck: CONTRIBUTING.md
• Exact-surface overlap: none detected among this open-PR union
• Owner next bounded action: Owner: re-read the exact current head/diff, run the narrowest relevant validation, and keep maintainer follow-up moving without duplicate bot triggers.
• Bot/review policy: no duplicate bot trigger and no human maintainer-review nudge; re-read current head/diff before any reply.
• Coordination boundary: public-safe packet only; no push, merge, publish, protected model/reasoning mutation, or process restart in this pass.

[grtninja]

Current-head coordination packet — 2026-08-09T22:00:57Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN / ready / mergeable=true; observed merge-state=see authoritative REST inventory; changed files=1
• Checks/workflows at this head: none reported
• Review state: 0 reviews (latest none) / 0 review threads / 0 current unresolved
• Current unresolved paths: none
• Contributor guidance recheck: CONTRIBUTING.md
• Exact-surface overlap: none detected among this open-PR union
• Owner next bounded action: Owner: re-read the exact current head/diff, run the narrowest relevant validation, and keep maintainer follow-up moving without duplicate bot triggers.
• Bot/review policy: no duplicate bot trigger and no human maintainer-review nudge; re-read current head/diff before any reply.
• Coordination boundary: public-safe packet only; no push, merge, publish, protected model/reasoning mutation, or process restart in this pass.

[grtninja]

Current-head coordination packet — 2026-08-10T04:00:32Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN / ready / mergeable=true; observed merge-state=see authoritative REST inventory; changed files=1
• Checks/workflows at this head: none reported
• Review state: 0 reviews / 0 review threads / 0 current unresolved
• Current unresolved paths: none
• Contributor guidance recheck: CONTRIBUTING.md
• Exact-surface overlap: none detected among this open-PR union
• Owner next bounded action: Owner: re-read the exact current head/diff, run the narrowest relevant validation, and keep maintainer follow-up moving without duplicate bot triggers.
• Bot/review policy: no duplicate bot trigger and no human maintainer-review nudge; re-read current head/diff before any reply.
• Coordination boundary: public-safe packet only; no push, merge, publish, protected model/reasoning mutation, or process restart in this pass.

[grtninja]

Current-head coordination packet — 2026-08-10T10:00:38Z

• Fresh 10:01Z refresh: authoritative 34-PR union unchanged versus 04:00Z; no head, state, merge-state, review/thread, check, or changed-file deltas.

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions

• Exact head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)

• State: OPEN / ready / mergeable=true; observed merge-state=see authoritative REST inventory; changed files=1

• Checks/workflows at this head: none reported

• Review state: 0 reviews / 0 review threads / 0 current unresolved

• Current unresolved paths: none

• Contributor guidance recheck: CONTRIBUTING.md

• Exact-surface overlap: none detected among this open-PR union

• Owner next bounded action: Owner: re-read the exact current head/diff, run the narrowest relevant validation, and keep maintainer follow-up moving without duplicate bot triggers.

• Bot/review policy: no duplicate bot trigger and no human maintainer-review nudge; re-read current head/diff before any reply.

• Coordination boundary: public-safe packet only; no push, merge, publish, protected model/reasoning mutation, or process restart in this pass.

[grtninja]

Current-head coordination packet — 2026-08-10 16:01:44Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact current head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN; mergeable=true; changed files=1
• Fresh connector refresh: exact head, base, state/draft, mergeability, changed-file count, review count/body/state/commit, review threads, current-unresolved set, guidance paths, and actionable overlaps match the 10:00Z baseline; no substantive maintainer/reviewer note changed.
• Merge-state evidence: direct REST merge-state refresh is temporarily degraded by Windows host admission; last direct REST snapshot is support evidence only (last direct REST support only). Do not treat that support snapshot as a new current merge-state claim.
• Exact-surface overlap: actionable groups unchanged (PennyGPT-Lite Not an issue but.. #11/Adding named DNS support for consideration #12/Adds local filesystem support #13; VRM-Sandbox Attempt ICMP checker #104/Dependency Dashboard #106/Fixes and improvements #109; skill-arbiter-private Updated Readme for build instructions with Docker #20/Do not fail on HTTP redirects, but do not follow them either, close #22. #23/Add .travis.yml file for CI build setup. #24; grtninja/ComfyUI "Ternary check mode" for more lightweight checks #1 versus Comfy-Org/ComfyUI #13362; mx3-public-shim Headers and auth for HTTP checks #8/Missing build and test instructions #9).
• Owner next bounded action: Owner: re-read the current head/diff, address current review findings, and run the narrowest relevant validation.
• Bot/review policy: no duplicate bot trigger and no human maintainer-review nudge; re-read current head and diff before any reply.
• Coordination boundary: public-safe packet only; no push, merge, publish, protected model/reasoning mutation, process restart, or process kill in this pass.

[grtninja]

Current-head coordination packet — 2026-08-10 22:01:41Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact current head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN; draft=false; mergeable=true; REST merge_state=clean; changed files=1
• Fresh connector refresh: exact head/base/state/draft/mergeability, review/thread/check, guidance, and actionable-overlap data were refreshed for all 34 open PRs; normalized direct-REST comparison to 10:01Z is zero; no substantive maintainer/reviewer note changed.
• Fresh review/thread/check evidence: connector refresh completed for 34/34 PRs; reviews=0, threads=0, current-unresolved=0; workflow/check records and guidance/overlap snapshots were refreshed.
• Merge-state evidence: direct Windows REST snapshot 2026-08-10T22:05:06Z reports mergeable=true, merge_state=clean; normalized comparison against the 10:01Z REST snapshot is zero.
• Exact-surface overlap: actionable groups unchanged (PennyGPT-Lite Not an issue but.. #11/Adding named DNS support for consideration #12/Adds local filesystem support #13; VRM-Sandbox Attempt ICMP checker #104/Dependency Dashboard #106/Fixes and improvements #109; skill-arbiter-private Updated Readme for build instructions with Docker #20/Do not fail on HTTP redirects, but do not follow them either, close #22. #23/Add .travis.yml file for CI build setup. #24; grtninja/ComfyUI "Ternary check mode" for more lightweight checks #1 versus Comfy-Org/ComfyUI #13362; mx3-public-shim Headers and auth for HTTP checks #8/Missing build and test instructions #9).
• Owner next bounded action: Owner: re-read the current head/diff, address current review findings, and run the narrowest relevant validation.
• Bot/review policy: no duplicate bot trigger and no human maintainer-review nudge; re-read current head and diff before any reply.
• Coordination boundary: public-safe packet only; no push, merge, publish, protected model/reasoning mutation, process restart, or process kill in this pass.

[grtninja]

Current-head coordination packet — 2026-08-11 04:00:16Z

• PR: ci: harden SCIP workflow permissions #163 — ci: harden SCIP workflow permissions
• Exact current head/base: 935ef24f82a6d0365020e22f42b8a8ec8b44cf50 / cdc8b7899beb72d7ffcf9b2a0e8b591add164150 (master)
• State: OPEN; draft=false; mergeable=true; REST merge_state=unknown; changed files=1
• Fresh connector refresh: exact head/base/state/draft/mergeability, review/thread/check, changed-file, guidance, overlap, and maintainer-note surfaces were refreshed for all 34 open PRs; structural comparison against 22:00Z is zero; the 28 REST comment-count increases are the prior 22:00Z packets, with no substantive comments after those markers.
• Fresh review/thread/check evidence: 34/34 connector metadata, reviews, threads, workflow runs/status, changed-file lists, and issue-comment timelines refreshed; reviews=0, threads=0, current-unresolved=0.
• Merge-state evidence: direct Windows REST snapshot 2026-08-11T04:09:41Z reports mergeable=true, merge_state=unknown; normalized structural comparison against 22:00Z is zero.
• Exact-surface overlap: actionable groups unchanged (PennyGPT-Lite Not an issue but.. #11/Adding named DNS support for consideration #12/Adds local filesystem support #13; VRM-Sandbox Attempt ICMP checker #104/Dependency Dashboard #106/Fixes and improvements #109; skill-arbiter-private Updated Readme for build instructions with Docker #20/Do not fail on HTTP redirects, but do not follow them either, close #22. #23/Add .travis.yml file for CI build setup. #24; grtninja/ComfyUI "Ternary check mode" for more lightweight checks #1 versus Comfy-Org/ComfyUI #13362; mx3-public-shim Headers and auth for HTTP checks #8/Missing build and test instructions #9).
• Owner next bounded action: Owner: re-read the current head/diff, address current review findings, and run the narrowest relevant validation.
• Bot/review policy: no duplicate bot trigger and no human maintainer-review nudge; re-read current head and diff before any reply.
• Coordination boundary: public-safe packet only; no push, merge, publish, protected model/reasoning mutation, process restart, or process kill in this pass.