ci: pin actions-tagger and restrict release workflow permissions

[EndBug]

Summary

• Pin Actions-R-Us/actions-tagger to commit SHA 330ddfac (v2.0.3) instead of the mutable @v2 tag.
• Add an explicit permissions: contents: write block so the release tag-update job only gets the scope it needs.

Test plan

• Confirm .github/workflows/versioning.yml uses the pinned SHA and permissions: contents: write
• On the next published/edited release, verify major/latest tags still update as before

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request updates GitHub Actions permissions and checkout security, standardizes workflows on Node.js 24, verifies committed lib/ output, pins the versioning action, and expands contributor instructions for building, committing generated files, and validating the action.

Changes

CI controls and contributor workflow

Layer / File(s)	Summary
Workflow permissions and build validation .github/workflows/test.yml, .github/workflows/versioning.yml	Workflows use explicit content permissions, Node.js 24, and non-persisted checkout credentials. The build job checks generated lib/ files and uploads an artifact when verification fails. The versioning workflow pins the actions-tagger commit.
Contributor build and validation instructions CONTRIBUTING.md	The instructions define the Node.js 24 build command, generated-file commit requirements, Husky behavior, CI consistency checks, and test-repository validation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant Checkout
  participant npmBuild
  participant Git
  participant ArtifactUpload
  GitHubActions->>Checkout: checkout without persisted credentials
  GitHubActions->>npmBuild: run build with Node.js 24
  npmBuild->>Git: compare generated lib with committed files
  Git-->>GitHubActions: return verification status
  GitHubActions->>ArtifactUpload: upload expected lib when verification fails

Loading

Possibly related PRs

• EndBug/add-and-commit#756: Includes the same CI lib/ verification, Node.js 24 updates, artifact upload, and contribution guidance changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main workflow security changes: pinning actions-tagger and restricting release workflow permissions.

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch cursor/ce2693b3

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/ce2693b3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}