Drop the unused attestations: write permission

[elhoim]

Finding 42 (Low) — .github/workflows/pypi-publish.yml:41-42

Problem

attestations: write is granted to the publish job but never used - PEP 740 attestation in pypa/gh-action-pypi-publish rides on id-token: write, and actions/attest-build-provenance is not invoked anywhere.

Fix

Finding #42 (low, unused-attestations-perm): the publish job in .github/workflows/pypi-publish.yml granted both id-token: write and attestations: write, but nothing in the workflow uses the attestations permission — pypa/gh-action-pypi-publish's PEP 740 attestation support rides entirely on id-token: write, and actions/attest-build-provenance is never invoked anywhere in the repo. Fix drops the unused attestations: write line, tightening the job's permission grant to only what it actually uses. This is a metadata/config finding with no runtime behavior to execute, so verification was by inspection (grep for any other attest reference — none found) plus YAML parsing to confirm the permissions block is still well-formed, and the standard CLI smoke test to confirm nothing else broke.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

$ grep -n "attest" .github/workflows/pypi-publish.yml
42:      attestations: write
$ grep -rn "attestations" .github/
.github/workflows/pypi-publish.yml:42:      attestations: write
(no other reference anywhere in .github/ — permission is granted but never consumed)

After

$ python3 -c "import yaml; d=yaml.safe_load(open('.github/workflows/pypi-publish.yml')); print(d['jobs']['publish']['permissions'])"
{'id-token': 'write'}
(attestations permission removed; only id-token: write remains, which is what the publish action actually needs)

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYX4TKA5inzByJ4qGWKjqh