fix(workflows): add job-level permissions to validate-version in extension-publish-prerelease

[WilliamBerryiii]

Description

Added an explicit empty permissions: {} block to the validate-version job in .github/workflows/extension-publish-prerelease.yml. This resolves OpenSSF Scorecard Token-Permissions alerts that flagged the job for missing job-level permissions.

The validate-version job performs pure shell computation for version string validation and does not require repository content access or elevated token permissions. The package and publish jobs already had explicit job-level permissions and required no changes.

Related Issue(s)

Fixes #524

Related to #456, #460

Type of Change

Select all that apply:

Code & Documentation:

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Infrastructure & Configuration:

• GitHub Actions workflow
• Linting configuration (markdown, PowerShell, etc.)
• Security configuration
• DevContainer configuration
• Dependency update

AI Artifacts:

• Reviewed contribution with prompt-builder agent and addressed all feedback
• Copilot instructions (.github/instructions/*.instructions.md)
• Copilot prompt (.github/prompts/*.prompt.md)
• Copilot agent (.github/agents/*.agent.md)
• Copilot skill (.github/skills/*/SKILL.md)

Note for AI Artifact Contributors:

• Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.
• Skills: Must include both bash and PowerShell scripts. See Skills.
• Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.
• See Agents Not Accepted and Model Version Requirements.

Other:

• Script/automation (.ps1, .sh, .py)
• Other (please describe):

Sample Prompts (for AI Artifact Contributions)

User Request:

Execution Flow:

Output Artifacts:

Success Indicators:

For detailed contribution requirements, see:

• Common Standards: docs/contributing/ai-artifacts-common.md - Shared standards for XML blocks, markdown quality, RFC 2119, validation, and testing
• Agents: docs/contributing/custom-agents.md - Agent configurations with tools and behavior patterns
• Prompts: docs/contributing/prompts.md - Workflow-specific guidance with template variables
• Instructions: docs/contributing/instructions.md - Technology-specific standards with glob patterns
• Skills: docs/contributing/skills.md - Task execution utilities with cross-platform scripts

Testing

Automated validation commands executed:

Check	Command	Result
Markdown linting	npm run lint:md	Passed
Spell checking	npm run spell-check	Passed (7 pre-existing issues in unrelated files)
Frontmatter validation	npm run lint:frontmatter	Passed
Skill structure validation	npm run validate:skills	Passed
Link validation	npm run lint:md-links	Passed
PowerShell analysis	npm run lint:ps	Passed
Plugin freshness	npm run plugin:generate	Passed (no changes)
YAML linting	npm run lint:yaml	Passed

Security analysis: The change restricts token permissions to the minimum required (none) for the validate-version job. No sensitive data exposure, dependency changes, or privilege escalation detected.

Diff-based assessment: Confirmed package and publish jobs already declare explicit job-level permissions. Verified that gh release view in the validate-version job works on public repositories without elevated token permissions.

Manual testing was not performed.

Checklist

Required Checks

• Documentation is updated (if applicable) (N/A — no documentation changes required)
• Files follow existing naming conventions
• Changes are backwards compatible (if applicable)
• Tests added for new functionality (if applicable) (N/A — no new functionality)

AI Artifact Contributions

• Used /prompt-analyze to review contribution
• Addressed all feedback from prompt-builder review
• Verified contribution follows common standards and type-specific requirements

Required Automated Checks

The following validation commands must pass before merging:

• Markdown linting: npm run lint:md
• Spell checking: npm run spell-check
• Frontmatter validation: npm run lint:frontmatter
• Skill structure validation: npm run validate:skills
• Link validation: npm run lint:md-links
• PowerShell analysis: npm run lint:ps
• Plugin freshness: npm run plugin:generate

Security Considerations

• This PR does not contain any sensitive or NDA information
• Any new dependencies have been reviewed for security issues (N/A — no dependency changes)
• Security-related scripts follow the principle of least privilege

Additional Notes

This is a minimal, single-line change that satisfies the OpenSSF Scorecard Token-Permissions requirement by adding an explicit permissions: {} block to the only job in extension-publish-prerelease.yml that lacked one. The empty permissions declaration correctly reflects that the job needs no elevated token permissions beyond what is inherited.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None