CI: add least-privilege permissions to GitHub Actions workflows

[peter-matkovski]

Summary

• Add explicit least-privilege permissions blocks to workflow files flagged by CodeQL.
• Scopes derived from workflow operations (build, artifacts, Danger, release git push).
• Resolves 3 open actions/missing-workflow-permissions alerts.

Linear

• Parent: APPSEC-164

Test plan

• CI green
• Code scanning alerts close after merge

Summary by CodeRabbit

• Chores
  • Improved CI workflow security by explicitly limiting workflow permissions.
  • Updated Android, iOS, and general CI workflows with clearer access controls.
  • No changes to application functionality or user-facing behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

The GitHub Actions workflows now define explicit top-level permissions, limiting repository contents access and specifying actions and pull-request access for the iOS workflow.

Changes

Workflow permission hardening

Layer / File(s)	Summary
Explicit workflow access permissions .github/workflows/android_ci.yml, .github/workflows/ci.yml, .github/workflows/ios_ci.yml	Android and general CI workflows grant contents: read; the iOS workflow grants actions: write, contents: read, and pull-requests: read.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: greenfrvr, santhoshvai

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding least-privilege permissions to GitHub Actions workflows.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/workflow-least-privilege-permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ios_ci.yml:
- Around line 12-16: Remove the top-level actions: write entry from the workflow
permissions block in ios_ci.yml, retaining only the permissions required by the
checkout, caching, dependency installation, and build steps. If a later job
explicitly needs Actions write access, move that permission into that job’s
permissions block instead.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0a93615d-77c2-403a-bd0c-b3642cc85725

📥 Commits

Reviewing files that changed from the base of the PR and between 8972b28 and 5729ec7.

📒 Files selected for processing (3)

• .github/workflows/android_ci.yml
• .github/workflows/ci.yml
• .github/workflows/ios_ci.yml