chore: restrict workflow permissions and tighten feed script removal

[julien-deramond]

The Integration, Lint and Weekly workflows now set permissions: contents: read at the top, so their jobs get a read-only GITHUB_TOKEN by default. The Weekly links job keeps its own block, which still grants issues: write for the broken-links report.

feedHtml in src/feeds.ts now removes <script> elements in any case, with attributes on the closing tag, and repeats until none is left.

What was done

• Each of the three workflow files gets one top-level permissions block. Nothing in them pushes with GITHUB_TOKEN. The showcase job reads public data through GraphQL, and its PR goes through SHOWCASE_PR_GITHUB_TOKEN, so it doesn't need write access.
• The script regex now has the i flag and accepts </script > or attributes on the end tag, inside a loop that stops when the string no longer changes. A new test in tests/feeds.test.ts covers an uppercase tag and a nested one.
• I compared the built feed.json with the live one. No article has a script element, so the feed content doesn't change. The only difference is the code-highlighting colours in one article, which script removal can't touch.
• All green locally with npm run prettier:check, npm run spellcheck, npm run test -- --run (79 passed), npm run build, npm run links.
• I couldn't run the Weekly workflow. It only runs on schedule or by hand, so the showcase job under the new permissions will only run on the next Monday or a manual dispatch.

How to review

• Check by hand: after merging, run the Weekly workflow once with "Run workflow" and check the showcase job still opens its PR.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openresource-dev	Ready	Preview	Oct 10, 2026 8:06pm UTC