Lint Github Actions

[jhnns]

We should add automatic linting of our Github Actions:

• zizmor
• Check if permissions is always set explicitly

Since we don't change Github Actions all the time, I don't think this should be a regular dependency of the project. It would be better to install it on demand when a Github Action needs linting.

[jhnns]

This is what my AI agent created for checking if a Github Action has a permissions field:

Details

import fs from "node:fs/promises";
import path from "node:path";

const workflowsDir = path.resolve(".github/workflows");

function isWorkflowFile(fileName) {
  return fileName.endsWith(".yml") || fileName.endsWith(".yaml");
}

function hasTopLevelPermissions(yamlText) {
  // Heuristic: require a non-commented `permissions:` key at column 0.
  // This avoids depending on a YAML parser while still preventing accidental
  // fallback to GitHub's default token permissions.
  return /^(?!\s*#)\s*permissions\s*:\s*(?:#.*)?$/m.test(yamlText);
}

const entries = await fs.readdir(workflowsDir, { withFileTypes: true });
const workflowFiles = entries
  .filter((e) => e.isFile() && isWorkflowFile(e.name))
  .map((e) => path.join(workflowsDir, e.name))
  .sort();

const failures = [];

for (const file of workflowFiles) {
  const text = await fs.readFile(file, "utf8");
  if (!hasTopLevelPermissions(text)) {
    failures.push(file);
  }
}

if (failures.length > 0) {
  console.error("Some workflows are missing an explicit top-level `permissions:` block:");
  for (const file of failures) console.error(`- ${file}`);
  console.error("");
  console.error(
    "Add a top-level `permissions:` block (least privilege) to avoid relying on default token permissions.",
  );
  process.exit(1);
}

console.log(`Workflow permissions policy OK (${workflowFiles.length} workflow(s) checked).`);