ci: harden Copilot setup workflow

[devantler]

🤖 Generated by the Daily AI Engineer

What changed

• deny permissions by default in the Copilot setup workflow and grant only job-scoped contents: read
• run the repository's existing pinned step-security/harden-runner action first with audited egress
• pin the directly installed mega-linter-runner version and document the narrowly scoped transitive-resolution exception
• remove the retired sync-labels.yaml entry from the AGENTS.md workflow inventory

Why

The Go template's adopter-facing Copilot setup workflow lagged the least-privilege pattern already used by the .NET template and by this repository's scaffold validation. Closing that parity gap prevents generated projects from inheriting broad workflow permissions or an unhardened setup runner.

The helper still installs globally because Copilot needs the CLI on PATH; a committed Node lockfile solely for this helper would add disproportionate weight to the minimal Go scaffold. The exact direct version reduces drift, while the inline exception explicitly records the remaining transitive-resolution risk.

This is workflow security infrastructure, not a user-facing feature, so feature-flagging is not applicable.

Promotion gate

CI and the current-head review are green, with zero unresolved threads or body findings. Repository pre-merge checks are disabled; #162 tracks the required dashboard setting. Keep this draft fail-closed until that setting is enabled and a supported formal green pre-merge result is posted.

Validation

• red/green structural assertions for permissions, harden-runner ordering, and the stale workflow inventory
• actionlint .github/workflows/copilot-setup-steps.yml
• zizmor .github/workflows/copilot-setup-steps.yml (0 findings; 1 documented exception)
• go build ./...
• go test ./... (7 tests across 3 packages)
• golangci-lint run
• sh scripts/rename-placeholders.test.sh
• sh .github/scripts/run-mockery.test.sh
• git diff --check

Fixes #160
Part of #104

[coderabbitai]

📝 Walkthrough

Walkthrough

The Copilot setup workflow now uses empty top-level permissions with job-scoped read access, runs a hardened runner in audit mode, and installs a pinned mega-linter-runner version. The repository structure documentation updates its workflow inventory by removing sync-labels.yaml and adding the current workflow files.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy #160 by adding default-deny permissions, harden-runner first, preserving setup behavior, and removing the stale AGENTS entry.
Out of Scope Changes check	✅ Passed	No unrelated code changes are evident beyond the requested workflow security updates and AGENTS.md inventory edit.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly summarizes the main change: hardening the Copilot setup workflow.
Description check	✅ Passed	The description accurately matches the workflow security and AGENTS.md updates in the changeset.

---

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Daily AI Engineer

@coderabbitai run pre-merge checks

The exact PR head is locally validated with actionlint, zizmor, Go build/test/lint, both scaffold helper regressions, and the least-privilege structural assertions. Please evaluate the linked child issue #160 and current two-file diff.

[coderabbitai]

✅ Actions performed

Running Pre-merge checks. Results will be posted in the summary comment once complete.

[coderabbitai]

ℹ️ Pre-merge checks are not enabled. To use pre-merge checks, please enable them in CodeRabbit settings.

[devantler]

🤖 Generated by the Daily AI Engineer

CodeRabbit confirmed that repository pre-merge checks are disabled, so this draft remains fail-closed despite CLEAN CI and zero review threads. #162 tracks the required dashboard setting. Do not repeat the bot command until that setting changes; once enabled, re-run the supported pre-merge check and require a formal green summary before promotion.

[devantler]

🤖 Generated by the Daily AI Engineer

@coderabbitai review

The adaptive review window has reopened. Please review exact head 6ed5d952; local and GitHub CI validation are green. Repository pre-merge checks remain separately tracked by #162.

[coderabbitai]

@devantler, understood — I'll review the PR at the current head commit 6ed5d952.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.