[neilime]

Plain source-test callers currently have to grant OIDC, PR-comment and CodeQL write permissions even when those features are disabled. Let the test and CodeQL jobs inherit the caller's permission grant so read-only calls can start. Other jobs keep their explicit permission limits.

Callers must grant only the scopes needed by the features they enable. Default checks still require security-events: write and pull-requests: write; Codecov additionally requires id-token: write. Inherited permissions apply to the entire test or CodeQL job, so callers must keep their grants narrow. Regenerated workflow documentation describes this contract.

Four hosted regression calls now grant only contents: read and packages: read: source tests without a build, disabled checks, source packaging without a build, and container tests without a build. Existing GitHub coverage, Codecov and CodeQL scenarios remain enabled.

Validation: 60 Node.js CI contract tests pass on Node.js 24. Markdown checks pass. Actionlint passes with only its two pre-existing dynamic container ports/volumes diagnostics excluded; Zizmor rejects that existing workflow shape before and after this change. Hosted CI will verify the read-only calls and enabled reporting paths.

Consumer migrations: hoverkraft-tech/ci-github-common#646, hoverkraft-tech/ci-github-publish#507 and hoverkraft-tech/ci-github-container#943.

[github-actions]

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Fail ❌
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Pass ✅
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter
Super-linter revision: 2da136927bd4a73596db63044b504547c62cb854
Super-linter version: 9.0.0

CHECKOV

dockerfile scan results:

Passed checks: 45, Failed checks: 0, Skipped checks: 0

github_actions scan results:

Passed checks: 618, Failed checks: 1, Skipped checks: 1

Check: CKV2_GHA_1: "Ensure top-level permissions are not set to write-all"
	FAILED for resource: on(Node.js Continuous Integration)
	File: /.github/workflows/continuous-integration.yml:8-9