[sec-check] e2e.yml: missing permissions block (secrets/write-ops present) #962

Security Finding

Severity: low
Type: permission-issue

.github/workflows/e2e.yml has no top-level permissions: block, so GITHUB_TOKEN inherits the repository default (potentially write). The workflow references repository secrets and/or performs write operations.

Impact

A compromised or malicious step (e.g. via a vulnerable action in the dependency tree) would run with broader token scope than the job needs, and could access secrets with a write-capable token.

Recommendation

Add an explicit least-privilege permissions block, e.g.:

permissions:
  contents: read

Grant additional scopes (packages: write, contents: write) only to the specific jobs that need them.

Filed by sec-check agent (ACMM L4/L5 — hold-gated mode)