Fix agent job permissions in dev.md to use explicit scoping

[Copilot]

Zizmor flagged the agent job in dev.md with Medium severity for inheriting permissions: read-all from workflow level instead of declaring explicit job-level permissions.

Changes

• Replaced workflow-level permissions: read-all with explicit scoping:

  permissions:
    contents: read
    pull-requests: read

Impact

Agent job now declares minimal required permissions. Other jobs (create_pull_request, conclusion) retain appropriate write permissions via compiler-generated explicit scopes.

Before:

permissions: read-all  # Workflow level

jobs:
  agent:
    permissions: read-all  # Inherited

After:

permissions:
  contents: read
  pull-requests: read

jobs:
  agent:
    permissions:
      contents: read
      pull-requests: read

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[plan] Fix Medium severity job permissions in dev.md</issue_title>
<issue_description>## Objective

Explicitly scope the agent job permissions in dev.md to follow the principle of least privilege.

Context

Zizmor flagged dev.md (line 219, agent job) with Medium severity for missing explicit job-level permissions. Job-level permissions should be explicitly defined rather than inheriting from workflow level.

Current State

The agent job lacks explicit permissions block, inheriting from workflow level which may grant more access than needed.

Approach

1. Add explicit permissions block to the agent job in dev.md
2. Define minimal required permissions:

   agent:
     permissions:
       contents: read
       pull-requests: read

3. Verify the job doesn't require additional permissions (issues, discussions, etc.)

Files to Modify

• .github/workflows/dev.md (agent job section, around line 219)

Testing

1. After changes, recompile: make recompile
2. Run zizmor scan: gh aw compile dev --zizmor
3. Verify zizmor no longer flags the Medium severity issue
4. Test workflow to ensure agent job functions correctly

Acceptance Criteria

• Agent job has explicit permissions block
• Permissions follow principle of least privilege
• Zizmor no longer reports Medium severity finding
• Workflow functionality verified
  Related to [plan] Address static analysis security findings #6350

AI generated by Plan Command for discussion #6330

Comments on the Issue (you are @copilot in this section)

• Fixes [plan] Fix Medium severity job permissions in dev.md #6352

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.