persistLocal generates act-test.yml without a permissions block (trips CodeQL) #95

Summary

The persistLocal feature generates .github/workflows/act-test.yml without a top-level permissions block. Because the file lives under .github/workflows/, GitHub treats it as a real workflow, and GitHub Advanced Security (CodeQL) immediately flags it:

Workflow does not contain permissions — Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block…

Every consumer that enables persistLocal and commits the generated workflow (the documented pattern) inherits this alert on their first PR.

Generated output (builder 0.7.1)

name: Local Test
on:
  workflow_dispatch:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/local

No permissions: key → default broad GITHUB_TOKEN scopes → CodeQL alert.

Expected

The generated act-test.yml should ship with a minimal least-privilege permissions block by default, e.g.:

name: Local Test
on:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/local

contents: read is sufficient for the checkout + local-action template. (An action under test that needs more can be widened by the consumer, but the generated default should be least-privilege, not unset.)

Notes

• persistLocal preserves an existing act-test.yml on rebuild (it does not overwrite), so this only needs fixing in the initial template/generation — once correct, it sticks. That's also why a consumer's manual permissions: edit survives, but consumers shouldn't have to discover and apply that workaround.
• Some already-migrated actions (e.g. silk-release-action) carry the permissions: block in their committed act-test.yml (apparently added by hand), while a freshly generated one (e.g. silk-sync-action) does not — confirming the generator, not the consumer, is the right place to fix this.

Repro

1. In any action repo, add action.config.ts with persistLocal: { enabled: true, path: ".github/actions/local" }.
2. pnpm run build.
3. Inspect .github/workflows/act-test.yml → no permissions: block.
4. Push → CodeQL "Workflow does not contain permissions" alert.

Context

Surfaced during the savvy-web/silk-sync-action migration; GitHub Advanced Security and the cloud reviewer both flagged the generated workflow on the PR. Worked around there by hand-adding permissions: contents: read, but the fix belongs in the generator.