fix(ci): least-privilege workflow permissions + esbuild override

[MisterWanted]

CodeQL alerts resolved

#1–#10 — Workflow does not contain permissions (Medium): adds a top-level permissions: contents: read to the four flagged workflows (rust.yml, external-tests.yml, python.yml, lua.yml). These workflows only build and test — artifact upload (actions/upload-artifact) and actions/cache require no elevated scopes — so least-privilege contents: read is sufficient for every job.

esbuild advisory (GHSA-g7r4-m6w7-qqqr, Low/Development): tsup's esbuild range (^0.27.0) currently resolves to 0.27.3–0.28.0, the vulnerable window for the Windows dev-server arbitrary file read. Pinned esbuild: 0.27.2 via packages/package.json overrides and regenerated both package-lock.json (used by external-tests.yml via npm ci) and bun.lock (used by oxc.yml via bun install --frozen-lockfile), so neither install path picks the vulnerable range.

Verification

• npm audit in packages/ → 0 vulnerabilities
• fff-node tests: 30 + 6 pass; tsup build + tsc types succeed on esbuild 0.27.2
• oxfmt --check and oxlint clean on the refreshed bun.lock
• All workflow YAML parses; no job requires more than contents: read

Note

Lift the esbuild override when a patched release (0.28.1+) ships — it's a one-line change in packages/package.json.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 3c395ae0-b943-436a-baf1-0ecbfe30c224

📥 Commits

Reviewing files that changed from the base of the PR and between cc8b417 and e964e5f.

⛔ Files ignored due to path filters (2)

• packages/bun.lock is excluded by !**/*.lock
• packages/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (5)

• .github/workflows/external-tests.yml
• .github/workflows/lua.yml
• .github/workflows/python.yml
• .github/workflows/rust.yml
• packages/package.json

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• GroepOnline/opencodex (manual)

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds read-only contents permissions to four GitHub Actions workflows. It reformats the package workspace list and pins esbuild to version 0.27.2.

Changes

CI and package configuration

Layer / File(s)	Summary
Read-only workflow permissions .github/workflows/external-tests.yml, .github/workflows/lua.yml, .github/workflows/python.yml, .github/workflows/rust.yml	The workflows now set workflow-level contents: read permissions.
Workspace and dependency configuration packages/package.json	The workspace array uses multi-line formatting, and an overrides block pins esbuild to 0.27.2.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to e964e

CI workflows now use read-only repository access, and workspace installs are pinned to esbuild 0.27.2. No merge-blocking production or user-impact risk is currently identified.

Suggested reviewers: web-flow, chefgroep

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The directly linked issue [#1] requires upgrading Rust rand from 0.8.5 to 0.9.4 and applying related compatibility updates. The reviewed changes address CI permissions and esbuild, with no evidence of…	Implement the rand 0.8.5 to 0.9.4 upgrade and all required Cargo dependency, compatibility, and lockfile changes. Alternatively, link this pull request to issues that cover the workflow permission and esbuild changes.
Out of Scope Changes check	⚠️ Warning	The workflow permission changes and esbuild override are outside the scope of linked issue [#1], which requests a Rust rand dependency upgrade.	Remove the unrelated workflow and esbuild changes from this pull request, or link appropriate issues that define those objectives. Keep the pull request focused on the rand 0.9.4 upgrade and related compatibility updates.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the workflow permission changes and esbuild override shown in the changeset.
Description check	✅ Passed	The description directly explains the workflow permission changes and esbuild override in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

The directly linked issue [#1] requires upgrading Rust rand from 0.8.5 to 0.9.4 and applying related compatibility updates. The reviewed changes address CI permissions and esbuild, with no evidence of the rand upgrade.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/codeql-workflow-permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}