ci(governance): harden workflows — timeouts, scorecard perms, secret gate, codeql actions, drop privileged workflow_run (#25)

Clears the pre-existing Hypatia workflow_audit findings (non-blocking, but tidies governance CI):
- timeout-minutes on all remaining jobs: release.yml (3), static-analysis-gate.yml (3), rhodibot.yml (1)
- instant-sync.yml (HIGH secret_action_without_presence_gate): gate the repository-dispatch step on
  FARM_DISPATCH_TOKEN presence so it no-ops without the secret
- scorecard.yml (HIGH scorecard_wrapper_missing_job_permissions): add job-level permissions to the
  reusable-wrapper job (security-events/id-token/contents/actions)
- codeql.yml (codeql_missing_actions_language): add the `actions` language so workflow files are scanned
- rhodibot.yml (CRITICAL): remove the privileged `workflow_run` trigger — it ran with contents/
  pull-requests write on Hypatia completion; rhodibot still runs via schedule + workflow_dispatch

Verified: all changed workflows parse as YAML; every non-reusable job now has timeout-minutes.


Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/codeql.yml

@@ -33,6 +33,8 @@ jobs:
         include:
           - language: javascript-typescript
             build-mode: none
+          - language: actions
+            build-mode: none
 
     steps:
       - name: Checkout

.github/workflows/instant-sync.yml

@@ -16,7 +16,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      - name: Check dispatch token presence
+        id: gate
+        run: echo "has_token=${{ secrets.FARM_DISPATCH_TOKEN != '' }}" >> "$GITHUB_OUTPUT"
       - name: Trigger Propagation
+        if: steps.gate.outputs.has_token == 'true'
         uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}

.github/workflows/release.yml

@@ -18,6 +18,7 @@ jobs:
   build:
     name: Build Artifacts
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
     steps:
@@ -42,6 +43,7 @@ jobs:
   changelog:
     name: Generate Changelog
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
     outputs:
@@ -88,6 +90,7 @@ jobs:
     name: Create GitHub Release
     needs: [build, changelog]
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: write
     steps:

.github/workflows/rhodibot.yml

@@ -16,9 +16,9 @@ on:
   schedule:
     - cron: '0 6 * * 1'  # Every Monday at 06:00 UTC
   workflow_dispatch:       # Manual trigger
-  workflow_run:
-    workflows: ["Hypatia Neurosymbolic Analysis"]
-    types: [completed]
+  # NOTE: the privileged `workflow_run` trigger (on Hypatia completion) was removed —
+  # it ran with contents/pull-requests write and was flagged as a critical workflow
+  # pattern. Rhodibot still runs weekly (schedule) and on demand (workflow_dispatch).
 
 permissions:
   contents: write
@@ -27,6 +27,7 @@ permissions:
 jobs:
   rhodibot:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

.github/workflows/scorecard.yml

@@ -12,5 +12,10 @@ permissions: read-all
 
 jobs:
   analysis:
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910
     secrets: inherit

.github/workflows/static-analysis-gate.yml

@@ -19,6 +19,7 @@ jobs:
   panic-attack-assail:
     name: panic-attack assail
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Checkout repository
@@ -123,6 +124,7 @@ jobs:
   hypatia-scan:
     name: Hypatia neurosymbolic scan
     runs-on: ubuntu-latest
+    timeout-minutes: 20
 
     steps:
       - name: Checkout repository
@@ -235,6 +237,7 @@ jobs:
   deposit-findings:
     name: Deposit findings for gitbot-fleet
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     needs: [panic-attack-assail, hypatia-scan]
     if: always()