[fupacat]

Summary

• Resolve SonarCloud githubactions:S8233 vulnerabilities in .github/workflows/javadoc-pages.yml and .github/workflows/release.yml by scoping pages: write, id-token: write, contents: write, and packages: write to the job level while keeping workflow-level permissions at contents: read.
• Resolve githubactions:S6573 in release.yml and javadoc-pages.yml by prefixing glob paths with ./.
• Add -Dsonar.qualitygate.wait=true and permissions: contents: read to .github/workflows/sonar.yml so the SonarCloud Scan status check fails immediately if the SonarCloud Quality Gate fails.

[Copilot]

🟡 Changes recommended

The build job in javadoc-pages.yml now runs actions/configure-pages with no pages permission, which will fail the "Configure GitHub Pages" step and break the Pages build.

1 open finding

• Build job missing pages read permission after scope change · New

What changed in this PR

This PR hardens three GitHub Actions workflows in response to SonarCloud findings. It applies least-privilege permissions by keeping workflow-level permissions at contents: read and scoping write permissions to the specific jobs that need them (addressing githubactions:S8233), prefixes shell glob paths with ./ to avoid option-injection (addressing githubactions:S6573), and makes the SonarCloud step fail fast when the Quality Gate fails.

Changes:

• release.yml: workflow-level contents: read; contents: write + packages: write moved to the release job; glob paths prefixed with ./.
• javadoc-pages.yml: pages: write + id-token: write moved from workflow level to the deploy job; Javadoc jar glob prefixed with ./.
• sonar.yml: added workflow-level permissions: contents: read and -Dsonar.qualitygate.wait=true to block on Quality Gate failures.

File	Description
.github/​workflows/​sonar.yml	Adds read-only workflow permissions and enforces Quality Gate wait so the status check reflects gate failures.
.github/​workflows/​release.yml	Restricts workflow permissions to read and grants write only to the release job; adds ./ glob prefixes.
.github/​workflows/​javadoc-pages.yml	Moves Pages/OIDC write permissions to the deploy job and ./-prefixes the Javadoc jar glob, but leaves the build job without any pages permission.

Note: This repository is configured with the MCSWE v3 gate-driven SDLC protocol. These changes are CI/infrastructure-only (.github/workflows) and do not introduce application source or test files, so the per-function TRACEABILITY_MAPPING/SRS requirements do not apply here.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.