feat(linter): add workflow permissions analysis with actions-permissions

[Copilot]

Integrates the @GitHubSecurityLab/actions-permissions action into the linter workflow to proactively analyze and optimize workflow permissions.

Changes Made

• New Job: Added permissions-analysis job to .github/workflows/linter.yml that runs the GitHubSecurityLab/actions-permissions action (v1.0.10)
• Documentation: Updated .github/workflows/linter.md to document the new permissions analysis feature
• Security: Uses minimal permissions (contents: read) following GitHub security best practices
• Consistency: Follows the same pattern as the existing actions-pinning job for file gathering and analysis
• Configuration: Analyzes the same workflow files defined in the action-files input, supports both full repo analysis and changed-files-only mode

The permissions analysis job runs in parallel with other linting jobs (Super-Linter, CodeQL, Ratchet) and helps identify opportunities to minimize workflow permissions based on actual usage.

Testing

• ✅ YAML syntax validation passes
• ✅ Super-linter validation completes successfully
• ✅ Code duplication checks pass (with appropriate jscpd ignore comments)
• ✅ Workflow structure verified programmatically

Fixes #346

Original prompt

---

This section details on the original issue you should resolve

<issue_title>feat(linter): add Workflow Permissions Analysis with @GitHubSecurityLab/actions-permissions</issue_title>
<issue_description>Is your feature request related to a problem? Please describe.
To proactively improve security, we want to analyze and optimize workflow permissions in our .github/workflows/linter.yml using the @GitHubSecurityLab/actions-permissions action.

Describe the solution you'd like
Integrate the @GitHubSecurityLab/actions-permissions action into the linter.yml workflow. The permissions analysis should ideally run as a separate job or step after the linter checks, follow GitHub best practices, and be well-documented.

Describe alternatives you've considered
Manually auditing and reviewing workflow permissions periodically, but automated analysis with the GitHubSecurityLab action is preferred for consistency and optimization.

Additional context
See the actions-permissions documentation for configuration details.
</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes #346

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[neilime]

@copilot you can get project instructions here: https://github.com/hoverkraft-tech/ci-github-common/blob/main/AGENTS.md

After reading them, please implement the issue as expected

[Copilot]

@copilot you can get project instructions here: https://github.com/hoverkraft-tech/ci-github-common/blob/main/AGENTS.md

After reading them, please implement the issue as expected

I've successfully implemented the workflow permissions analysis feature as requested in issue #346.

Changes made (commits 19d2857 and a2946ea):

1. Added a new permissions-analysis job to .github/workflows/linter.yml that runs the @GitHubSecurityLab/actions-permissions action
2. The job follows the same pattern as actions-pinning for consistency:
   • Runs on the same runners as other linting jobs
   • Analyzes the same workflow files specified in action-files input
   • Only runs when action-files input is provided
   • Uses minimal permissions (contents: read)
3. Updated .github/workflows/linter.md documentation to include the new permissions analysis feature
4. Added jscpd ignore comments to suppress expected code duplication between similar jobs

The implementation follows GitHub security best practices and integrates seamlessly with the existing linter workflow infrastructure.