fix: keep approve-pr CI test unprivileged

[devantler]

Motivation

🤖 Generated by the Daily AI Assistant.

• Mitigate a CI/CD supply-chain secret exposure where a pull-request could run a PR-controlled local composite action (./approve-pr) with a GitHub App private key and write permissions.
• Preserve the CI validation of the approve-pr action while ensuring PRs cannot receive real secrets or a write-capable token.

Description

• Reduced the test-approve-pr job permissions to contents: read so it no longer grants write capabilities to PR-run jobs in .github/workflows/ci.yaml.
• Removed passing vars.APP_CLIENT_ID and secrets.APP_PRIVATE_KEY into the PR-controlled local action and replaced the private key with a non-secret placeholder app-private-key: dry-run-placeholder.
• Enabled the action's dry-run path by adding dry-run: true to the approve-pr invocation so the test exercises the action without minting an App token or approving the PR.

Testing

• Repository sanity checks (git diff --check) passed.
• YAML parse via Ruby/Psych succeeded for the modified workflow file.
• Targeted grep/sed check confirmed the test-approve-pr job contains neither secret expressions nor write permissions and reported success.
• Lint tools (yamllint, zizmor, actionlint) could not be executed due to outbound package/download restrictions in the execution environment, so they were not run here.

---

Codex Task

[github-code-quality]

Code Coverage Overview

Languages: Go, C#

Go / code-coverage/test

The overall coverage remains at 50%, unchanged from the main branch.

C# / code-coverage/dotnet

The overall coverage remains at 100%, unchanged from the main branch.

---

_{Updated July 20, 2026 09:44 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	0.38s
✅ GO	revive	2		0	0	10.2s
✅ REPOSITORY	betterleaks	yes		no	no	0.69s
✅ REPOSITORY	checkov	yes		no	no	18.32s
✅ REPOSITORY	gitleaks	yes		no	no	0.15s
✅ REPOSITORY	git_diff	yes		no	no	0.05s
✅ REPOSITORY	osv-scanner	yes		no	no	0.54s
✅ REPOSITORY	secretlint	yes		no	no	0.78s
✅ REPOSITORY	syft	yes		no	no	2.54s
✅ REPOSITORY	trivy	yes		no	no	12.62s
✅ REPOSITORY	trivy-sbom	yes		no	no	0.16s
✅ REPOSITORY	trufflehog	yes		no	no	5.37s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

• Documentation: Custom Flavors
• Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters COPYPASTE_JSCPD,GO_REVIVE,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG

Show us your support by starring ⭐ the repository

[devantler]

Requested by the 🤖 Daily AI Engineer — CI is green at the current head and this draft carries no qualifying review, so requesting the lane-priority reviewer. Hygiene only: this is a sibling lane's draft and its owner promotes it.

[devantler]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 98f46a2. Configure here.}