[Grace-ope]

Summary

Closes #121 (SW-105).

Static conformance audit for explicit least-privilege permissions on workflows.

Acceptance criteria

• PR/CI workflows rejected for write-all / contents: write / unexpected writes
• Release elevated perms allowlisted by job id
• Fixtures demonstrate prohibited broad permissions fail
• Audit runs with existing contents: read — no permission expansion
• npm test + npm run audit:workflow-permissions for repo workflows

Test plan

npm run audit:workflow-permissions
npm test -- tests/workflow-permissions.test.ts

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b4558bf3-1c63-4fe5-82e5-696566e68341

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}