add webhook identity context to alerts and typed workflow permissions

Include actor/account github identity details in installation and repo lifecycle alerting, add shared identity helpers, and tighten CI workflow permission typing for safer validation.

Co-authored-by: Cursor <cursoragent@cursor.com>

external.ts

@@ -61,6 +61,28 @@ export type ToolPermission = "disabled" | "enabled";
 export type BashPermission = "disabled" | "restricted" | "enabled";
 export type PushPermission = "disabled" | "restricted" | "enabled";
 
+// workflow yml permissions for GITHUB_TOKEN
+export type WorkflowPermissionValue = "read" | "write" | "none";
+export type WorkflowIdTokenPermissionValue = "write" | "none";
+
+export interface WorkflowPermissions {
+  actions?: WorkflowPermissionValue;
+  attestations?: WorkflowPermissionValue;
+  checks?: WorkflowPermissionValue;
+  contents?: WorkflowPermissionValue;
+  deployments?: WorkflowPermissionValue;
+  discussions?: WorkflowPermissionValue;
+  "id-token"?: WorkflowIdTokenPermissionValue;
+  issues?: WorkflowPermissionValue;
+  models?: WorkflowPermissionValue;
+  packages?: WorkflowPermissionValue;
+  pages?: WorkflowPermissionValue;
+  "pull-requests"?: WorkflowPermissionValue;
+  "repository-projects"?: WorkflowPermissionValue;
+  "security-events"?: WorkflowPermissionValue;
+  statuses?: WorkflowPermissionValue;
+}
+
 // permission level for the author who triggered the event
 // matches GitHub's permission levels: admin > write > maintain > triage > read > none
 export type AuthorPermission = "admin" | "maintain" | "write" | "triage" | "read" | "none";

test/ci.test.ts

@@ -4,7 +4,7 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 import { parse } from "yaml";
-import { agentsManifest } from "../external.ts";
+import { agentsManifest, type WorkflowPermissions } from "../external.ts";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const actionDir = join(__dirname, "..");
@@ -13,7 +13,7 @@ const rootDir = join(actionDir, "..");
 type WorkflowJob = {
   "runs-on": string;
   "timeout-minutes"?: number;
-  permissions?: Record<string, string>;
+  permissions?: WorkflowPermissions;
   strategy?: { "fail-fast": boolean; matrix: Record<string, string[]> };
   env?: Record<string, string>;
   steps?: unknown[];