[jaywedgeworth22]

Summary

Updates GITHUB_TOKEN permissions in .github/workflows/autofix.yml from empty ({}) to contents: write, pull-requests: read, and issues: write. The in-code comment describes these grants as capping the called reusable workflow for PR reads, issue marker comments, and contents push fallback, attributing the scope to owner rationale dated 2026-10-21 (unverified).

Operational impact

Autofix triggers (issue_comment, pull_request, pull_request_review, pull_request_review_comment) now request the expanded token scopes. No workflow logic was changed and no test additions or test runs are evidenced in the diff; runtime behavior remains unverified.

Open risk

Automated review reported one unresolved medium finding for .github/workflows/autofix.yml:14 regarding overly permissive top-level permissions on the issue_comment workflow.

---

Summary

Updates scripts/autofix-workflows.node-test.mjs to require autofix.yml workflow-level permissions to be exactly contents: write, pull-requests: read, and issues: write instead of permissions: {}. The existing job-level least-privilege and fork invocation guards are unchanged.

Rationale

Per the inline comment, these are the owner-approved caller grants (owner 2026-10-21, re-approved 2026-11-10 for PR #1644). The reusable workflow's token is capped by these caller grants, so any additional workflow-level permission must update this guard in the same change.

Testing

This patch modifies only the test guard; no workflow file change is included. No test run evidence was provided, so passing behavior is unverified.

Open risk

Automated review reported 1 medium finding that remains unresolved: scripts/autofix-workflows.node-test.mjs:91 — exact permissions guard allows appended workflow scopes.

[jaywedgeworth22]

Closing as stale: this visibility draft has had no commit in 19 days and its CI is red.  Nothing is deleted: the branch stays on the remote, and the PR can be reopened if the work resumes.  Fleet draft sweep: AFC-679.

[kody-ai]

Automatic approval held

Kody's assessment:

The review is not clean.

[swu-rob]

Note from the Nov 9 draft burn-down (MA): this PR was flipped ready and its checks re-ran before the stale-close landed. Every completed check on the fresh run was green (32 runs; the two typecheck + test suites were still running when the close arrived), so the "CI is red" premise reflects the old October runs, not the current head. The change itself is a 7-line autofix.yml permissions grant documented in its own comment as owner-approved 2026-10-21, and main's autofix.yml still carries the empty permissions block it replaces. It could not be landed from the relay: git-data writes to .github/workflows/ are refused (the relay App lacks the workflows permission). Reopen and land it from a route with workflow-file write access if the grant is still wanted.

[kody-ai]

Code Review Completed! 🔥

The code review was successfully completed based on your current configurations.

⚠️ 2 Kody Rule(s) were not evaluated

These rules declare that they need repository context beyond this diff, and the review could not retrieve it, so they were not judged on this pull request:

• Use Zod .strict() on schemas that parse internally-written cache/config files
• Wrap fire-and-forget async calls with .catch backstops

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

Automatic approval held: The review is not clean.

[swu-rob]

Closing as superseded — reopening this was my error. This morning I verified only the top-level block (permissions: {} on main) and missed that main’s autofix.yml already carries the full grant set at job level: decide holds pull-requests: read + issues: write, the autofix job holds contents: write + pull-requests: read + issues: write (verified live on main blob 97e3a7fa today). The grant the owner approved is therefore already in effect in its least-privilege form; this branch would only duplicate it more broadly at workflow level, against Kody’s security finding and the repo’s own guard test. My guard-test patch on this branch (b70a3c0) is discarded with it. Branch preserved. — MA