fix(workflows): least-privilege permissions; catch remaining stale action versions

[eleshar]

Summary

Follow-up to #2355 (merged). Targets #2351 (release/v1.0.0).

Missed scope in #2355: that PR only bumped action versions under .github/workflows/. Repo-wide grep found 10 more workflow-shaped files still pinned to old majors — workflows/*.yml (the top-level "portable agentic workflows" folder), and design-md-lint.yml under agents/*/skills/ and skills/. This is what PR #2351's CI annotation was flagging (actions/github-script@v7 forced onto the deprecated Node 20 runner). All bumped to @v9, verified against the GitHub API — no stragglers remain repo-wide (checked via grep -rhoP across every .yml/.yaml).

Least-privilege permissions, the item flagged in the original review and deferred:

• changelog.yml, flaky-test-detection.yml, linting.yml, testing.yml — none of these write to the repo or call the GitHub API; added permissions: contents: read.
• pr-template-validation.yml — no checkout, no API calls at all (only reads context.payload.pull_request.body via github-script); set permissions: {}.
• meta-agent-validation.yml — has two github.rest.issues.createComment calls on pull_request; added contents: read + pull-requests: write.
• The other 12 flagged in the original review (badges-*, docs-validation.yml, issue-health-audit.yml, issue-labeling-automation.yml, issue-remediation-automation.yml, metrics-collection.yml, validate-dor-dod-sections.yml, validate-mermaid-pr.yml) already had correctly-scoped job-levelpermissions: blocks — my first pass's grep "^permissions:" only checked column 0 and missed those. Verified each still matches what its steps actually need; left untouched.

Test plan

• CI on this branch passes, including validate-pr-template (should stop flagging Node 20/github-script@v7)
• Confirm meta-agent-validation.yml's PR-comment step still succeeds with pull-requests: write (was previously running with whatever the org/repo default token permissions grant)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (5)

• main
• develop
• feature/*
• fix/*
• update/*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: a95b10f2-7ca0-47fa-8462-e3299628c21d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

.coderabbit.yml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized keys: "auto_labels", "auto_assign", "auto_review"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🚫 This PR description is missing required template content.

Missing required section(s): Linked issues, Changelog, Global DoD checklist

Please update the PR body using one of the repository PR templates:

• https://github.com/lightspeedwp/.github/blob/develop/.github/pull_request_template.md
• https://github.com/lightspeedwp/.github/tree/develop/.github/PULL_REQUEST_TEMPLATE

Empty placeholders, unchecked checklist boxes, and stub issue references do not count.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-27 11:03 UTC · Rule: dependabot-develop · triggered by merge protections
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-08-27 11:03 UTC · at c0e984cdcb8d2938da72e4ceb02408da62598e20 · squash

This pull request spent 11 seconds in the queue, including 2 seconds running CI.

Required conditions to merge

[github-actions]

Milestone Allocation

node:internal/modules/package_json_reader:314
throw new ERR_MODULE_NOT_FOUND(packageName, fileURLToPath(base), null);
^
Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'octokit' imported from /home/runner/work/.github/.github/scripts/automation/allocate-to-milestone.js
at Object.getPackageJSONURL (node:internal/modules/package_json_reader:314:9)
at packageResolve (node:internal/modules/esm/resolve:768:81)
at moduleResolve (node:internal/modules/esm/resolve:855:18)
at defaultResolve (node:internal/modules/esm/resolve:985:11)
at #cachedDefaultResolve (node:internal/modules/esm/loader:747:20)
at ModuleLoader.resolve (node:internal/modules/esm/loader:724:38)
at ModuleLoader.getModuleJobForImport (node:internal/modules/esm/loader:320:38)
at ModuleJob._link (node:internal/modules/esm/module_job:182:49) {
code: 'ERR_MODULE_NOT_FOUND'
}
Node.js v22.23.2