From bc21e4688ad794c32502a8a94c735f0c4fc859e8 Mon Sep 17 00:00:00 2001
From: McGroarty <git@mcgroarty.me>
Date: Wed, 3 Jun 2026 17:29:13 -0700
Subject: [PATCH 1/2] Add permissions section to CI workflow for content access

---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21e91f6..e1abf12 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   build-and-lint:
     name: Build and Lint

From 4e4a4507d82a982d8c7862e8fd754b769e1fec92 Mon Sep 17 00:00:00 2001
From: McGroarty <git@mcgroarty.me>
Date: Wed, 3 Jun 2026 17:32:30 -0700
Subject: [PATCH 2/2] Address Code Scanning alerts

- ci.yml: add least-privilege permissions block (contents: read)

- ci.yml/deploy.yml: pin pnpm/action-setup to commit SHA

- fetch-definitions.js: suppress js/http-to-file-access (OUTPUT_PATH is hardcoded)
---
 .github/workflows/ci.yml     | 2 +-
 .github/workflows/deploy.yml | 2 +-
 scripts/fetch-definitions.js | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e1abf12..8a7ae41 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
           node-version: '24'
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 12fce7f..54c6318 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -28,7 +28,7 @@ jobs:
           node-version: '24'
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: 10
 
diff --git a/scripts/fetch-definitions.js b/scripts/fetch-definitions.js
index 7cbe519..6d9f44d 100644
--- a/scripts/fetch-definitions.js
+++ b/scripts/fetch-definitions.js
@@ -24,7 +24,8 @@ export async function fetchDefinitions(url = DEFAULT_URL) {
     // Ensure the directory exists
     await mkdir(dirname(OUTPUT_PATH), { recursive: true });
 
-    // Write the file
+    // OUTPUT_PATH is hardcoded via import.meta.url; HTTP response cannot influence the write location.
+    // lgtm[js/http-to-file-access]
     await writeFile(OUTPUT_PATH, content, 'utf8');
 
     console.log(`Successfully saved LSL definitions to: ${OUTPUT_PATH}`);