openhound-github 0.8.0__tar.gz → 0.9.0__tar.gz

{openhound_github-0.8.0 → openhound_github-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openhound-github
-Version: 0.8.0
+Version: 0.9.0
 Summary: Github collector for OpenHound
 Author-email: "jdreijer@specterops.io" <jdreijer@specterops.io>, Jared Atkinson <jatkinson@specterops.io>
 License-File: LICENSE.md

{openhound_github-0.8.0 → openhound_github-0.9.0}/descriptions/edges/GH_CanPwnRequest.md

@@ -41,7 +41,7 @@ An attacker who exploits a pwn request gains code execution in the workflow runn
 
 ### Caveats
 
-- **OIDC traversal requires `id-token: write`**: The attack chain from GH_CanPwnRequest through GH_CanAssumeIdentity to a cloud role is only valid if the pwn-requestable workflow (or job) explicitly declares `id-token: write` in its `permissions:` block. The `id-token` permission defaults to `none` and is never implicitly granted — even when the workflow has no `permissions:` block at all. The `permissions` property on the GH_WorkflowJob node can be inspected to verify this.
+- **OIDC traversal requires `id-token: write`**: The attack chain from GH_CanPwnRequest through GH_CanAssumeIdentity to a cloud role is only valid if the pwn-requestable job's calculated `effective_github_token_permissions` includes `id-token:write`. The `id-token` permission defaults to `none` and is never implicitly granted — even when the workflow has no `permissions:` block at all. Inspect `workflow_permissions` on GH_Workflow, `job_permissions` on GH_WorkflowJob, and the job's `effective_github_token_permissions` to understand how the effective value was derived.
 - **GITHUB_TOKEN permissions**: The `permissions:` block controls what the `GITHUB_TOKEN` can do (e.g., push commits, create releases), but has no effect on secret access, OIDC token requests (governed separately by `id-token`), or arbitrary code execution. A workflow with `contents: read` is still fully exploitable via pwn request for secret exfiltration and lateral movement — only write-back to the repository is limited.
 
 ## Edge Schema

{openhound_github-0.8.0 → openhound_github-0.9.0}/descriptions/nodes/GH_Repository.md

@@ -4,6 +4,8 @@
 
 Represents a GitHub repository within the organization. Repository nodes capture metadata about the repo including visibility, Actions enablement status, and security configuration. Repository role nodes (GH_RepoRole) are created alongside each repository to represent the permission levels available.
 
+For repositories with active workflows, the collector records the applicable default workflow permissions and whether workflows may approve pull request reviews. These properties preserve the repository-level policy input later used to derive effective GITHUB_TOKEN permissions for GH_WorkflowJob nodes.
+
 ## Properties
 
 | Property | Type | Description |
@@ -40,6 +42,8 @@ Represents a GitHub repository within the organization. Repository nodes capture
 | `secret_scanning` | `string` | Status of secret scanning (e.g., `enabled`, `disabled`). |
 | `branch_ruleset_count` | `integer` | Number of branch-targeted rulesets that apply to this repository. |
 | `has_branch_rulesets` | `boolean` | Whether at least one branch-targeted ruleset applies to this repository. |
+| `default_workflow_permissions` | `string` | The repository's applicable default GITHUB_TOKEN workflow permissions. |
+| `can_approve_pull_request_reviews` | `boolean` | Whether workflows may approve pull request reviews. |
 | `query_branches` | `string` | Query for branches. |
 | `query_protected_branches` | `string` | Query for protected branches. |
 | `query_branch_protection_rules` | `string` | Query for branch protection rules. |

{openhound_github-0.8.0 → openhound_github-0.9.0}/descriptions/nodes/GH_Workflow.md

@@ -4,6 +4,8 @@
 
 Represents a GitHub Actions workflow defined in a repository. Workflow nodes capture the workflow definition metadata including its file path, state, containing repository, and the full YAML contents of the workflow file. Only repositories with GitHub Actions enabled are queried for workflows.
 
+When present, `workflow_permissions` captures the top-level `permissions` declaration from the workflow YAML.
+
 ## Properties
 
 | Property | Type | Description |
@@ -25,6 +27,7 @@ Represents a GitHub Actions workflow defined in a repository. Workflow nodes cap
 | `triggers` | `list[string]` | The triggers value. |
 | `trigger_dispatch_inputs` | `list[string]` | The trigger dispatch inputs value. |
 | `is_pwn_requestable` | `boolean` | The is pwn requestable value. |
+| `workflow_permissions` | `list[string]` | Permissions declared at the workflow level. |
 | `query_repository` | `string` | Query for repository. |
 | `query_jobs` | `string` | Query for workflow jobs. |
 | `query_execution` | `string` | Query for workflow executions. |

{openhound_github-0.8.0 → openhound_github-0.9.0}/descriptions/nodes/GH_WorkflowJob.md

@@ -6,6 +6,8 @@ Represents a single job within a GitHub Actions workflow. Jobs are the top-level
 
 When the job has a statically resolvable self-hosted `runs-on` selector, GH_RunsOn edges identify each GH_Runner that currently satisfies the declared label and runner-group constraints under the repository's runner access policy. These edges represent schedulability, not historical execution.
 
+When present, `job_permissions` captures the job-level `permissions` declaration from the workflow YAML. `effective_github_token_permissions` captures the calculated static `GITHUB_TOKEN` permissions after applying the repository default, workflow-level declaration, and job-level declaration.
+
 ## Properties
 
 | Property | Type | Description |
@@ -23,7 +25,9 @@ When the job has a statically resolvable self-hosted `runs-on` selector, GH_Runs
 | `is_self_hosted` | `boolean` | Whether the job targets self-hosted runners. |
 | `container` | `string` | The optional container configuration. |
 | `environment` | `string` | The deployment environment name. |
-| `permissions` | `list[string]` | Effective job permissions. |
+| `permissions` | `list[string]` | Applicable declared workflow or job permissions after job-over-workflow precedence. |
+| `job_permissions` | `list[string]` | Optional permissions declared at the job level; absent when the job has no declaration. |
+| `effective_github_token_permissions` | `list[string]` | Calculated GITHUB_TOKEN permissions after repository defaults and declarations are applied. |
 | `uses_reusable` | `string` | The reusable workflow reference used by this job. |
 | `workflow_node_id` | `string` | The parent workflow node ID. |
 | `repository_name` | `string` | The containing repository name. |

{openhound_github-0.8.0 → openhound_github-0.9.0}/extension/saved_searches/README.md

@@ -79,21 +79,25 @@ Pre-built Cypher queries for identifying security-relevant configurations across
 | 39 | `dangerous-branch-perms.json` | Dangerous Branch Permissions | Identifies users with dangerous branch permissions in a GitHub organization, including bypass allowances on protection rules. |
 | 40 | `org-roles-bypass-security-scanning.json` | Org Roles That Can Bypass Security Scanning | Finds organization roles with permissions to bypass or manage security scanning dismissals. These roles can suppress secret scanning and code scanning findings. |
 | 41 | `github-to-azure-identity.json` | GitHub-to-Azure Identity Assumptions | Finds GitHub entities (repositories, branches, environments) that can assume Azure identities via OIDC federation. Verify that each trust relationship is intentional and scoped appropriately. |
+| 42 | `workflow-jobs-with-id-token-write.json` | Workflow Jobs with OIDC Token Permission | Returns workflow jobs whose effective GITHUB_TOKEN permissions include `id-token:write`. |
+| 43 | `workflow-jobs-with-id-token-write-on-self-hosted-runners.json` | OIDC-Capable Workflow Jobs on Self-Hosted Runners | Returns OIDC-capable jobs that can be scheduled on collected self-hosted runners. |
+| 44 | `workflow-jobs-with-broad-token-write-permissions.json` | Workflow Jobs with Broad GITHUB_TOKEN Write Permissions | Returns jobs with effective write access to repository contents, Actions, or pull requests. |
+| 45 | `workflow-jobs-with-observed-oidc-auth-steps.json` | Workflow Jobs with Observed OIDC Authentication Steps | Returns OIDC-capable jobs with descendant steps that show likely token consumption. |
 
 ### :white_circle: Low — Hygiene & Governance
 
 | # | File | Name | Description |
 |---|------|------|-------------|
-| 42 | `environments-admin-bypass.json` | Environments Where Admins Can Bypass Protections | Finds deployment environments where administrators can bypass protection rules such as required reviewers and wait timers. Admins can deploy to these environments without any approval. |
-| 43 | `app-installations-all-repos.json` | App Installations with Access to All Repositories | Finds GitHub App installations that have access to every repository in the organization. A compromised app credential would affect all repositories. |
-| 44 | `users-without-external-identity.json` | GitHub Users Without External Identity Mapping | Finds GitHub users that are not linked to any external identity via SAML or SCIM. These users cannot be centrally offboarded through the identity provider and may retain access after employment ends. |
-| 45 | `external-identities-without-scim.json` | External Identities Without SCIM Provisioning | Finds external identities that lack SCIM synchronization. Without SCIM, user deprovisioning in the identity provider will not automatically revoke GitHub access. |
-| 46 | `org-owners.json` | Organization Owners | Returns all users who hold the organization owners role. |
-| 47 | `privileged-custom-org-roles.json` | Privileged Custom Org Roles | Returns all custom organization roles that are privileged (i.e., have permissions that are not default). |
-| 48 | `global-repo-perms.json` | Global Repo Permissions | Returns all users who hold a global repository permission role (i.e., roles that are not default). |
-| 49 | `hybrid-identities.json` | External Identities | Returns all external identities (e.g., Azure or Okta users) that are associated with GitHub users. |
-| 50 | `privileged-hybrid-identities.json` | Privileged Hybrid Identities | Returns all hybrid identities (e.g., Azure or Okta users) that are associated with GitHub users who hold the organization owners role. |
-| 51 | `saml-configuration.json` | SAML Configuration Mapping | Finds SAML Identity Providers, their external identities, and mapped users. |
-| 52 | `team-membership-admin.json` | Team Membership Admins | Returns all users who hold the maintainer role over a team, including team nesting. |
-| 53 | `team-structure.json` | Team Structure | Returns the structure of teams within organizations, including team roles and their members. |
-| 54 | `repository-workflows.json` | Repository Workflows | Returns all repository workflows. |
+| 46 | `environments-admin-bypass.json` | Environments Where Admins Can Bypass Protections | Finds deployment environments where administrators can bypass protection rules such as required reviewers and wait timers. Admins can deploy to these environments without any approval. |
+| 47 | `app-installations-all-repos.json` | App Installations with Access to All Repositories | Finds GitHub App installations that have access to every repository in the organization. A compromised app credential would affect all repositories. |
+| 48 | `users-without-external-identity.json` | GitHub Users Without External Identity Mapping | Finds GitHub users that are not linked to any external identity via SAML or SCIM. These users cannot be centrally offboarded through the identity provider and may retain access after employment ends. |
+| 49 | `external-identities-without-scim.json` | External Identities Without SCIM Provisioning | Finds external identities that lack SCIM synchronization. Without SCIM, user deprovisioning in the identity provider will not automatically revoke GitHub access. |
+| 50 | `org-owners.json` | Organization Owners | Returns all users who hold the organization owners role. |
+| 51 | `privileged-custom-org-roles.json` | Privileged Custom Org Roles | Returns all custom organization roles that are privileged (i.e., have permissions that are not default). |
+| 52 | `global-repo-perms.json` | Global Repo Permissions | Returns all users who hold a global repository permission role (i.e., roles that are not default). |
+| 53 | `hybrid-identities.json` | External Identities | Returns all external identities (e.g., Azure or Okta users) that are associated with GitHub users. |
+| 54 | `privileged-hybrid-identities.json` | Privileged Hybrid Identities | Returns all hybrid identities (e.g., Azure or Okta users) that are associated with GitHub users who hold the organization owners role. |
+| 55 | `saml-configuration.json` | SAML Configuration Mapping | Finds SAML Identity Providers, their external identities, and mapped users. |
+| 56 | `team-membership-admin.json` | Team Membership Admins | Returns all users who hold the maintainer role over a team, including team nesting. |
+| 57 | `team-structure.json` | Team Structure | Returns the structure of teams within organizations, including team roles and their members. |
+| 58 | `repository-workflows.json` | Repository Workflows | Returns all repository workflows. |

openhound_github-0.9.0/extension/saved_searches/workflow-jobs-with-broad-token-write-permissions.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Workflow Jobs with Broad GITHUB_TOKEN Write Permissions",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]->(:GH_Workflow)-[:GH_Contains]->(job:GH_WorkflowJob)\nWHERE 'contents:write' IN job.effective_github_token_permissions\nOR 'actions:write' IN job.effective_github_token_permissions\nOR 'pull-requests:write' IN job.effective_github_token_permissions\nRETURN p\nLIMIT 1000",
+  "description": "Returns workflow jobs whose calculated effective GITHUB_TOKEN permissions include write access to repository contents, Actions, or pull requests. These permissions can materially increase the impact of workflow compromise."
+}

openhound_github-0.9.0/extension/saved_searches/workflow-jobs-with-id-token-write-on-self-hosted-runners.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: OIDC-Capable Workflow Jobs on Self-Hosted Runners",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]->(:GH_Workflow)-[:GH_Contains]->(job:GH_WorkflowJob)-[:GH_RunsOn]->(:GH_Runner)\nWHERE 'id-token:write' IN job.effective_github_token_permissions\nRETURN p\nLIMIT 1000",
+  "description": "Returns OIDC-capable workflow jobs that can be scheduled on collected self-hosted runners. These jobs are especially important to review because runner compromise could expose short-lived cloud federation tokens."
+}

openhound_github-0.9.0/extension/saved_searches/workflow-jobs-with-id-token-write.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Workflow Jobs with OIDC Token Permission",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]->(:GH_Workflow)-[:GH_Contains]->(job:GH_WorkflowJob)\nWHERE 'id-token:write' IN job.effective_github_token_permissions\nRETURN p\nLIMIT 1000",
+  "description": "Returns workflow jobs whose calculated effective GITHUB_TOKEN permissions include id-token:write. These jobs can request GitHub OIDC tokens, though additional step analysis is needed to determine whether the token is actually used."
+}

openhound_github-0.9.0/extension/saved_searches/workflow-jobs-with-observed-oidc-auth-steps.json

@@ -0,0 +1,5 @@
+{
+  "name": "GitHub: Workflow Jobs with Observed OIDC Authentication Steps",
+  "query": "MATCH p=(repo:GH_Repository)-[:GH_Contains]->(:GH_Workflow)-[:GH_Contains]->(job:GH_WorkflowJob)-[:GH_Contains]->(step:GH_WorkflowStep)\nWHERE 'id-token:write' IN job.effective_github_token_permissions\nAND (\n  step.action_slug = 'aws-actions/configure-aws-credentials'\n  OR step.action_slug = 'azure/login'\n  OR step.action_slug = 'Azure/login'\n  OR step.action_slug = 'actions/deploy-pages'\n  OR step.contents CONTAINS 'getIDToken'\n  OR step.contents CONTAINS 'ACTIONS_ID_TOKEN_REQUEST_URL'\n  OR step.contents CONTAINS 'ACTIONS_ID_TOKEN_REQUEST_TOKEN'\n)\nRETURN p\nLIMIT 1000",
+  "description": "Returns OIDC-capable workflow jobs with direct descendant steps that show likely OIDC token consumption, including common AWS, Azure, GitHub Pages, and direct token-request patterns. This is evidence of likely use, not a complete classifier for every possible OIDC consumer; reusable workflow callers may require following GH_CallsWorkflow to find the consuming steps."
+}

{openhound_github-0.8.0 → openhound_github-0.9.0}/src/openhound_github/lookup.py

@@ -512,6 +512,34 @@ class GithubLookup(LookupManager):
             return None
         return int(row[0])
 
+    @lru_cache
+    def repository_workflow_permissions(
+        self, repository_node_id: str
+    ) -> tuple[str | None, bool | None] | None:
+        row = self._find_single_row(
+            f"""
+            SELECT
+                repository_default_workflow_permissions,
+                repository_can_approve_pull_request_reviews
+            FROM {self.schema}.workflows
+            WHERE repository_node_id = ?
+            LIMIT 1
+            """,
+            [repository_node_id],
+        )
+        if row is None:
+            return None
+
+        default_workflow_permissions, can_approve_pull_request_reviews = row
+        return (
+            default_workflow_permissions,
+            (
+                None
+                if can_approve_pull_request_reviews is None
+                else bool(can_approve_pull_request_reviews)
+            ),
+        )
+
     @lru_cache
     def repository_default_branch_collected(self, repository_node_id: str) -> bool:
         """Return whether the repository's REST default branch was collected."""

{openhound_github-0.8.0 → openhound_github-0.9.0}/src/openhound_github/models/repository.py

@@ -41,6 +41,8 @@ class GHRepositoryProperties(GHNodeProperties):
         environment_name: The name of the environment (GitHub organization).
         actions_enabled: Whether GitHub Actions is enabled for this repository.
         self_hosted_runners_enabled: Whether the repository may use self-hosted runners.
+        default_workflow_permissions: The repository's applicable default GITHUB_TOKEN workflow permissions.
+        can_approve_pull_request_reviews: Whether workflows may approve pull request reviews.
         secret_scanning: Status of secret scanning (e.g., `enabled`, `disabled`).
         branch_ruleset_count: Number of branch-targeted rulesets that apply to this repository.
         has_branch_rulesets: Whether at least one branch-targeted ruleset applies to this repository.
@@ -87,6 +89,8 @@ class GHRepositoryProperties(GHNodeProperties):
     environment_name: str | None = None
     actions_enabled: bool | None = None
     self_hosted_runners_enabled: bool | None = None
+    default_workflow_permissions: str | None = None
+    can_approve_pull_request_reviews: bool | None = None
     secret_scanning: str | None = None
     branch_ruleset_count: int | None = None
     has_branch_rulesets: bool | None = None
@@ -226,6 +230,10 @@ class Repository(BaseAsset):
     def as_node(self) -> GHNode:
         rid = self.node_id
         branch_ruleset_count = self._lookup.repository_branch_ruleset_count(rid)
+        workflow_permissions = self._lookup.repository_workflow_permissions(rid)
+        default_workflow_permissions, can_approve_pull_request_reviews = (
+            workflow_permissions if workflow_permissions else (None, None)
+        )
         return GHNode(
             kinds=[nk.REPOSITORY],
             properties=GHRepositoryProperties(
@@ -256,6 +264,8 @@ class Repository(BaseAsset):
                 environmentid=self.org_node_id,
                 actions_enabled=self.actions_enabled,
                 self_hosted_runners_enabled=self.self_hosted_runners_enabled,
+                default_workflow_permissions=default_workflow_permissions,
+                can_approve_pull_request_reviews=can_approve_pull_request_reviews,
                 branch_ruleset_count=branch_ruleset_count,
                 has_branch_rulesets=(
                     branch_ruleset_count > 0

{openhound_github-0.8.0 → openhound_github-0.9.0}/src/openhound_github/models/workflow.py

@@ -101,6 +101,137 @@ class RunsOnSelector(BaseModel):
     is_dynamic: bool = False
 
 
+GITHUB_TOKEN_PERMISSION_SCOPES = (
+    "actions",
+    "artifact-metadata",
+    "attestations",
+    "checks",
+    "code-quality",
+    "contents",
+    "deployments",
+    "discussions",
+    "id-token",
+    "issues",
+    "models",
+    "packages",
+    "pages",
+    "pull-requests",
+    "security-events",
+    "statuses",
+    "vulnerability-alerts",
+)
+READ_ONLY_GITHUB_TOKEN_PERMISSION_SCOPES = {"models", "vulnerability-alerts"}
+WRITE_ONLY_GITHUB_TOKEN_PERMISSION_SCOPES = {"id-token"}
+
+
+def normalize_permission_declaration(value: Any) -> list[str] | None:
+    if value is None:
+        return None
+
+    if isinstance(value, str):
+        return [value]
+
+    if isinstance(value, list):
+        return [str(item) for item in value]
+
+    if isinstance(value, dict):
+        return [f"{key!s}:{item!s}" for key, item in value.items()]
+
+    return [str(value)]
+
+
+def _empty_github_token_permissions() -> dict[str, str]:
+    return {scope: "none" for scope in GITHUB_TOKEN_PERMISSION_SCOPES}
+
+
+def _all_github_token_permissions(
+    access: str, *, include_id_token: bool = True
+) -> dict[str, str]:
+    permissions = _empty_github_token_permissions()
+    for scope in GITHUB_TOKEN_PERMISSION_SCOPES:
+        if scope in WRITE_ONLY_GITHUB_TOKEN_PERMISSION_SCOPES:
+            permissions[scope] = (
+                "write" if access == "write" and include_id_token else "none"
+            )
+        elif scope in READ_ONLY_GITHUB_TOKEN_PERMISSION_SCOPES:
+            permissions[scope] = "read"
+        else:
+            permissions[scope] = access
+    return permissions
+
+
+def _default_github_token_permissions(default_workflow_permissions: str | None):
+    if default_workflow_permissions is None:
+        return None
+
+    default = default_workflow_permissions.casefold()
+    if default == "read":
+        permissions = _empty_github_token_permissions()
+        permissions["contents"] = "read"
+        permissions["packages"] = "read"
+        return permissions
+    if default == "write":
+        return _all_github_token_permissions("write", include_id_token=False)
+    return None
+
+
+def _expand_permission_declaration(value: Any) -> dict[str, str] | None:
+    if value is None:
+        return None
+
+    if isinstance(value, str):
+        declaration = value.casefold()
+        if declaration == "read-all":
+            return _all_github_token_permissions("read")
+        if declaration == "write-all":
+            return _all_github_token_permissions("write")
+        return None
+
+    if isinstance(value, list):
+        if not value:
+            return _empty_github_token_permissions()
+        if len(value) == 1 and ":" not in str(value[0]):
+            return _expand_permission_declaration(str(value[0]))
+
+        normalized: dict[str, str] = {}
+        for item in value:
+            scope, separator, access = str(item).partition(":")
+            if not separator:
+                return None
+            normalized[scope] = access
+        value = normalized
+
+    if not isinstance(value, dict):
+        return None
+
+    permissions = _empty_github_token_permissions()
+    for raw_scope, raw_access in value.items():
+        scope = str(raw_scope).casefold()
+        permissions[scope] = str(raw_access).casefold()
+    return permissions
+
+
+def resolve_effective_github_token_permissions(
+    default_workflow_permissions: str | None,
+    workflow_permissions: Any,
+    job_permissions: Any,
+) -> list[str] | None:
+    permissions = _default_github_token_permissions(default_workflow_permissions)
+
+    for declaration in (workflow_permissions, job_permissions):
+        if declaration is None:
+            continue
+        expanded = _expand_permission_declaration(declaration)
+        if expanded is None:
+            return None
+        permissions = expanded
+
+    if permissions is None:
+        return None
+
+    return [f"{scope}:{access}" for scope, access in permissions.items()]
+
+
 def parse_runs_on_selector(value: Any) -> RunsOnSelector:
     """Normalize a workflow job's runs-on declaration without losing group data."""
     if value is None:
@@ -293,6 +424,7 @@ class GHWorkflowProperties(GHNodeProperties):
         html_url: The GitHub web URL for the workflow file.
         branch: The branch where the workflow file was found.
         contents: The content of the workflow file.
+        workflow_permissions: Permissions declared at the workflow level.
         query_repository: Query for repository.
         query_jobs: Query for workflow jobs.
         query_execution: Query for workflow executions.
@@ -310,6 +442,7 @@ class GHWorkflowProperties(GHNodeProperties):
     html_url: str | None = None
     branch: str | None = None
     contents: str | None = None
+    workflow_permissions: list[str] | None = None
     triggers: list[str] | None = None
     trigger_dispatch_inputs: list[str] | None = None
     is_pwn_requestable: bool = False
@@ -373,6 +506,8 @@ class Workflow(BaseAsset):
     org_login: str
     repository_name: str
     repository_node_id: str
+    repository_default_workflow_permissions: str | None = None
+    repository_can_approve_pull_request_reviews: bool | None = None
 
     @property
     def org_node_id(self) -> str | None:
@@ -429,6 +564,13 @@ class Workflow(BaseAsset):
 
         return [str(key) for key in inputs.keys()]
 
+    @property
+    def workflow_permissions(self) -> list[str] | None:
+        document = self.document
+        if not document:
+            return None
+        return normalize_permission_declaration(document.permissions)
+
     @property
     def pull_request_target_branches(self) -> list[str] | None:
         document = self.document
@@ -571,6 +713,12 @@ class Workflow(BaseAsset):
                     "permissions": job.permissions
                     if job.permissions is not None
                     else document.permissions,
+                    "job_permissions": job.permissions,
+                    "effective_github_token_permissions": resolve_effective_github_token_permissions(
+                        self.repository_default_workflow_permissions,
+                        document.permissions,
+                        job.permissions,
+                    ),
                     "uses_reusable": job.uses,
                     "workflow_node_id": self.node_id,
                     "repository_name": self.repository_name,
@@ -656,6 +804,7 @@ class Workflow(BaseAsset):
                 html_url=self.html_url,
                 branch=self.branch,
                 contents=self._decoded_contents,
+                workflow_permissions=self.workflow_permissions,
                 triggers=self.trigger_events,
                 trigger_dispatch_inputs=self.workflow_dispatch_inputs,
                 # is_pwn_requestable=self.is_pwn_requestable,

{openhound_github-0.8.0 → openhound_github-0.9.0}/src/openhound_github/models/workflow_job.py

@@ -21,7 +21,11 @@ from openhound_github.graph import GHNode, GHNodeProperties
 from openhound_github.kinds import edges as ek
 from openhound_github.kinds import nodes as nk
 from openhound_github.main import app
-from openhound_github.models.workflow import parse_runs_on_selector
+from openhound_github.models.workflow import (
+    normalize_permission_declaration,
+    parse_runs_on_selector,
+    resolve_effective_github_token_permissions,
+)
 
 TEMPLATE_RE = re.compile(r"\$\{\{\s*[^}]+?\s*\}\}")
 
@@ -44,7 +48,9 @@ class GHWorkflowJobProperties(GHNodeProperties):
         is_self_hosted: Whether the job targets self-hosted runners.
         container: The optional container configuration.
         environment: The deployment environment name.
-        permissions: Effective job permissions.
+        permissions: Applicable declared workflow or job permissions after job-over-workflow precedence.
+        job_permissions: Optional permissions declared at the job level; absent when the job has no declaration.
+        effective_github_token_permissions: Calculated GITHUB_TOKEN permissions after repository defaults and declarations are applied.
         uses_reusable: The reusable workflow reference used by this job.
         workflow_node_id: The parent workflow node ID.
         repository_name: The containing repository name.
@@ -65,6 +71,8 @@ class GHWorkflowJobProperties(GHNodeProperties):
     container: str | None = None
     environment: str | None = None
     permissions: list[str] | None = None
+    job_permissions: list[str] | None = None
+    effective_github_token_permissions: list[str] | None = None
     uses_reusable: str | None = None
     workflow_node_id: str | None = None
     repository_name: str | None = None
@@ -182,6 +190,8 @@ class WorkflowJob(BaseAsset):
     container: str | None = None
     environment: str | None = None
     permissions: list[str] | None = None
+    job_permissions: list[str] | None = None
+    effective_github_token_permissions: list[str] | None = None
     uses_reusable: str | None = None
     dependency_node_ids: list[str] = Field(default_factory=list)
     secret_references: list[WorkflowReference] = Field(default_factory=list)
@@ -191,22 +201,15 @@ class WorkflowJob(BaseAsset):
     def org_node_id(self) -> str | None:
         return self._lookup.org_id_for_login(self.org_login)
 
-    @field_validator("permissions", mode="before")
+    @field_validator(
+        "permissions",
+        "job_permissions",
+        "effective_github_token_permissions",
+        mode="before",
+    )
     @classmethod
     def normalize_permissions(cls, value: Any) -> list[str] | None:
-        if value is None:
-            return None
-
-        if isinstance(value, str):
-            return [value]
-
-        if isinstance(value, list):
-            return [str(item) for item in value]
-
-        if isinstance(value, dict):
-            return [f"{str(key)}:{str(value)}" for key, value in value.items()]
-
-        return [str(value)]
+        return normalize_permission_declaration(value)
 
     @model_validator(mode="before")
     @classmethod
@@ -233,6 +236,20 @@ class WorkflowJob(BaseAsset):
             str(label).casefold() for label in (self.runs_on_labels or self.runs_on or [])
         }
 
+    @property
+    def calculated_effective_github_token_permissions(self) -> list[str] | None:
+        workflow_permissions = self._lookup.repository_workflow_permissions(
+            self.repository_node_id
+        )
+        default_workflow_permissions = (
+            workflow_permissions[0] if workflow_permissions else None
+        )
+        return resolve_effective_github_token_permissions(
+            default_workflow_permissions,
+            self.permissions,
+            None,
+        )
+
     @property
     def as_node(self) -> GHNode:
         jid = self.node_id
@@ -251,6 +268,8 @@ class WorkflowJob(BaseAsset):
                 container=self.container,
                 environment=self.environment,
                 permissions=self.permissions,
+                job_permissions=self.job_permissions,
+                effective_github_token_permissions=self.calculated_effective_github_token_permissions,
                 uses_reusable=self.uses_reusable,
                 workflow_node_id=self.workflow_node_id,
                 repository_name=self.repository_name,

{openhound_github-0.8.0 → openhound_github-0.9.0}/src/openhound_github/resources/organization.py

@@ -122,6 +122,9 @@ class SourceContext:
     actions_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     runner_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     workflow_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
+    repository_workflow_permissions_cache: dict[str, dict[str, Any]] = field(
+        default_factory=dict
+    )
 
 
 class RepositoryRoleCache:
@@ -230,6 +233,19 @@ def _workflow_permissions(
     )
 
 
+def _repository_workflow_permissions(
+    ctx: SourceContext, client: RESTClient, repository_full_name: str
+) -> dict[str, Any]:
+    cache_key = repository_full_name.casefold()
+    if cache_key not in ctx.repository_workflow_permissions_cache:
+        with ctx.cache_lock:
+            if cache_key not in ctx.repository_workflow_permissions_cache:
+                ctx.repository_workflow_permissions_cache[cache_key] = client.get(
+                    f"/repos/{repository_full_name}/actions/permissions/workflow"
+                ).json()
+    return ctx.repository_workflow_permissions_cache[cache_key]
+
+
 def _rest_teams_for_org(
     ctx: SourceContext, client: RESTClient, org_name: str
 ) -> list[dict[str, Any]]:
@@ -1360,7 +1376,10 @@ def workflows(repo: Repository, ctx: SourceContext):
 
     @app.defer
     def _workflow_file_contents(
-        client: RESTClient, repo: Repository, workflow: dict[str, Any]
+        client: RESTClient,
+        repo: Repository,
+        workflow: dict[str, Any],
+        workflow_permissions: dict[str, Any],
     ) -> dict | None:
         path = workflow.get("path")
         if not path:
@@ -1382,15 +1401,28 @@ def workflows(repo: Repository, ctx: SourceContext):
             "repository_name": repo.name,
             "repository_node_id": repo.node_id,
             "org_login": repo.org_login,
+            "repository_default_workflow_permissions": workflow_permissions.get(
+                "default_workflow_permissions"
+            ),
+            "repository_can_approve_pull_request_reviews": workflow_permissions.get(
+                "can_approve_pull_request_reviews"
+            ),
         }
 
     client = _client_for_org(ctx, repo.org_login)
+    workflow_permissions: dict[str, Any] | None = None
     for page in client.paginate(
         f"/repos/{repo.full_name}/actions/workflows", params={"per_page": 100}
     ):
         for workflow in page:
             if workflow.get("state") == "active":
-                yield _workflow_file_contents(client, repo, workflow)
+                if workflow_permissions is None:
+                    workflow_permissions = _repository_workflow_permissions(
+                        ctx, client, repo.full_name
+                    )
+                yield _workflow_file_contents(
+                    client, repo, workflow, workflow_permissions
+                )
 
 
 @app.transformer(name="workflow_jobs", columns=WorkflowJob, parallelized=True)

{openhound_github-0.8.0 → openhound_github-0.9.0}/src/openhound_github/source.py

@@ -177,6 +177,9 @@ class SourceContext:
     actions_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     runner_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
     workflow_permissions_cache: dict[str, dict[str, Any]] = field(default_factory=dict)
+    repository_workflow_permissions_cache: dict[str, dict[str, Any]] = field(
+        default_factory=dict
+    )
 
     @property
     def org_names(self) -> list[str]:

{openhound_github-0.8.0 → openhound_github-0.9.0}/src/openhound_github/transforms.py

@@ -172,6 +172,13 @@ def ensure_optional_input_tables(
             labels JSON,
             repository_node_id VARCHAR
         );
+        CREATE TABLE IF NOT EXISTS {schema}.workflows (
+            name VARCHAR,
+            path VARCHAR,
+            repository_node_id VARCHAR,
+            repository_default_workflow_permissions VARCHAR,
+            repository_can_approve_pull_request_reviews BOOLEAN
+        );
     """)
     con.execute(f"""
         ALTER TABLE {schema}.branches
@@ -387,6 +394,17 @@ def ensure_optional_input_tables(
             ADD COLUMN IF NOT EXISTS labels JSON;
         ALTER TABLE {schema}.repo_runners
             ADD COLUMN IF NOT EXISTS repository_node_id VARCHAR;
+
+        ALTER TABLE {schema}.workflows
+            ADD COLUMN IF NOT EXISTS name VARCHAR;
+        ALTER TABLE {schema}.workflows
+            ADD COLUMN IF NOT EXISTS path VARCHAR;
+        ALTER TABLE {schema}.workflows
+            ADD COLUMN IF NOT EXISTS repository_node_id VARCHAR;
+        ALTER TABLE {schema}.workflows
+            ADD COLUMN IF NOT EXISTS repository_default_workflow_permissions VARCHAR;
+        ALTER TABLE {schema}.workflows
+            ADD COLUMN IF NOT EXISTS repository_can_approve_pull_request_reviews BOOLEAN;
     """)
 
 # TODO: