Fix/token permissions id 20260911

.github/workflows/codeql.yml

@@ -29,13 +29,13 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1
+        uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3.28.1
+        uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v3
         with:
           category: "/language:${{ matrix.language }}"
 

.github/workflows/dependabot-automerge.yml

@@ -41,7 +41,7 @@ on:
     types: [opened, reopened, synchronize]
 
 permissions:
-  contents: write        # needed to enable auto-merge
+  contents: read        # needed to enable auto-merge
   pull-requests: write   # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.
 

.github/workflows/ingest.yml

@@ -15,7 +15,7 @@ on:
         required: true
 
 permissions:
-  contents: write
+  contents: read
 
 # Serialize ingests: concurrent repository_dispatch deliveries race on
 # the commit+push and one writer loses. Queue them instead.

.github/workflows/rsr-antipattern.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: MPL-2.0
 #
 # Enforces: No TypeScript, No Go, No Python (except SaltStack), No npm
-# Allows: ReScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
+# Allows: AffineScript, Deno, WASM, Rust, OCaml, Haskell, Guile/Scheme
 
 name: RSR Anti-Pattern Check
 
@@ -29,7 +29,7 @@ jobs:
           # Exclude .d.ts files - those are TypeScript type declarations for ReScript FFI
           TS_FILES=$(find . \( -name "*.ts" -o -name "*.tsx" \) | grep -v node_modules | grep -v 'bindings/deno' | grep -v '\.d\.ts$' || true)
           if [ -n "$TS_FILES" ]; then
-            echo "❌ TypeScript files detected - use ReScript instead"
+            echo "❌ TypeScript files detected - use AffineScript instead"
             echo "$TS_FILES"
             exit 1
           fi
@@ -65,7 +65,7 @@ jobs:
       - name: Check for tsconfig
         run: |
           if [ -f "tsconfig.json" ]; then
-            echo "❌ tsconfig.json detected - use ReScript instead"
+            echo "❌ tsconfig.json detected - use AffineScript instead"
             exit 1
           fi
           echo "✅ No tsconfig.json"
@@ -84,7 +84,7 @@ jobs:
           echo "╔════════════════════════════════════════════════════════════╗"
           echo "║           RSR Anti-Pattern Check Passed ✅                 ║"
           echo "║                                                            ║"
-          echo "║  Allowed: ReScript, Deno, WASM, Rust, OCaml, Haskell,     ║"
+          echo "║  Allowed: AffineScript, Deno, WASM, Rust, OCaml, Haskell, ║"
           echo "║           Guile/Scheme, SaltStack (Python)                 ║"
           echo "║                                                            ║"
           echo "║  Blocked: TypeScript, Go, npm, Python (non-Salt)          ║"

.github/workflows/ts-blocker.yml

@@ -27,9 +27,9 @@ jobs:
           NEW_JS=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(js|jsx)$' | grep -v '\.res\.js$' | grep -v '\.gen\.' | grep -v 'node_modules' || true)
 
           if [ -n "$NEW_TS" ] || [ -n "$NEW_JS" ]; then
-            echo "❌ New TS/JS files detected. Use ReScript instead."
+            echo "❌ New TS/JS files detected. Use AffineScript instead."
             [ -n "$NEW_TS" ] && echo "$NEW_TS"
             [ -n "$NEW_JS" ] && echo "$NEW_JS"
             exit 1
           fi
-          echo "✅ ReScript policy enforced"
+          echo "✅ AffineScript policy enforced"