fix(ci): repair the permissions block indentation (invalid YAML)

[hyperpolymath]

The permissions: block was appended one level too deep (job-child indent + 2), making the file invalid YAML so the workflow cannot load. Dedented to job-key level; the file is re-parsed before commit.

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a6348ee9-d4f0-4010-9c82-c4ca6fe792cd

📥 Commits

Reviewing files that changed from the base of the PR and between f426b9d and 2078219.

📒 Files selected for processing (1)

• .github/workflows/mirror.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 37 issues detected

Severity	Count
🔴 Critical	1
🟠 High	14
🟡 Medium	22

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "reason": "Required file missing (condition: public_repo)",
    "type": "missing_requirement",
    "file": "SECURITY.md",
    "action": "create",
    "rule_module": "cicd_rules",
    "severity": "high"
  },
  {
    "line": 56,
    "reason": "job in .github/workflows/dependabot-automerge.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/dependabot-automerge.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 74,
    "reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 52,
    "reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 38,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 48,
    "reason": "workflow .github/workflows/dependabot-automerge.yml:48 gates on `github.actor == 'dependabot[bot]'` — `github.actor` is the run-triggering user, which an attacker controls on `pull_request_target` from a fork",
    "type": "RE008",
    "file": ".github/workflows/dependabot-automerge.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "critical"
  },
  {
    "line": null,
    "reason": "workflow .github/workflows/dependabot-automerge.yml has top-level `permissions:` with `contents: write` AND performs a write (push/commit/release/PR). It is over-broad, but narrowing the workflow level alone WOULD BREAK IT — no job declares its own `permissions:`.",
    "type": "WH002",
    "file": ".github/workflows/dependabot-automerge.yml",
    "action": "report",
    "rule_module": "workflow_hardening",
    "severity": "warn"
  },
  {
    "line": 12,
    "reason": "workflow .github/workflows/mirror.yml:12 uses `secrets: inherit` — forwards every caller secret to the reusable workflow",
    "type": "WH008",
    "file": ".github/workflows/mirror.yml",
    "action": "report",
    "rule_module": "workflow_hardening",
    "severity": "warn"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence