Recompile Dependabot Triage workflow with strict-safe permissions

[Copilot]

This updates the Dependabot Triage agent workflow to compile cleanly under current gh-aw strict-mode rules. The workflow source and compiled lockfile are now aligned with least-privilege permission requirements.

• Workflow source update (.md)

  • Reduced top-level permission from pull-requests: write to pull-requests: read in:
    • .github/workflows/dependabot-triage-agent.md
  • This preserves required PR read capability while removing disallowed write scope at frontmatter level.

• Workflow recompilation (.lock.yml)

  • Recompiled dependabot-triage-agent with gh aw compile.
  • Regenerated .github/workflows/dependabot-triage-agent.lock.yml to reflect updated frontmatter hash and compiled permission model.

• Permission delta (core change)

# .github/workflows/dependabot-triage-agent.md
permissions:
  contents: read
  issues: read
  pull-requests: read
  security-events: read

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• github.github.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)
• https://api.github.com/repos/actions/github-script/git/ref/tags/v8
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha ys-e3cca8f5c8c3f7ca/out/openssl-build/install/include/openssl/objects.h lib-der_sm2_gen.o /usr/local/sbin/as tperr.h mb-x86_64.s -fPIC e --gd�� /build/openssl-sys-e3cca8f5c8c3f7ca/out/openssl-build/install/include/openssl/x509v3.h --noexecstack bin/rustc crypto/bn/libcrysh crypto/bn/rsaz-x-c /x86_64-linux-gngit status --porcelain --ignore-submodules | head -n 10 bin/rustc (http block)
  • Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha ys-e3cca8f5c8c3f7ca/out/openssl-build/install/include/openssl/pkcs12err.h lib-der_rsa_sig.o lib-der_sm2_gen.o j_mac.h lib-der_sm2_sig.--crate-name bio_prov.o capabilities.o dige�� /build/openssl-s--error-format=json provider_util.o 8856e09263 securitycheck_degh phers/libdefaultextension phers/libdefaultinstall 8856e09263 (http block)
• https://api.github.com/repos/github/gh-aw/git/ref/tags/v0.58.2
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.58.2 --jq .object.sha ys-e3cca8f5c8c3f7ca/out/openssl-build/install/include/openssl/obj_mac.h lib-der_sm2_gen.o s tp.h mb-x86_64.s ndor/bin/as e --gd�� ys-e3cca8f5c8c3f7ca/out/openssl-build/install/include/openssl/symhacks.h --noexecstack bin/rustc festack.h crypto/bn/rsaz-x-c /bin/sh bin/rustc (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v0.58.2 --jq .object.sha ys-e3cca8f5c8c3f7ca/out/openssl-build/install/include/openssl/pkcs12.h ure/libdefault-lib-eddsa_sig.d k/_temp/ghcca-node/node/bin/as des.h crypto/bn/rsaz-2--crate-name -DOPENSSL_USE_NOopenssl_sys ons --gd�� ys-e3cca8f5c8c3f--error-format=json --noexecstack 7b881b75d7680d oreerr.h crypto/bn/x86_64--norc DELETE 7b881b75d7680d (http block)
• https://api.github.com/repos/github/gh-aw/releases/latest
  • Triggering command: /usr/bin/gh gh extension install github/gh-aw embed-bitcode=no -C debuginfo=2 --cfg feature="default" --cfg feature="vendored" --check-cfg e ys-e3cca8f5c8c3f7ca/out/openssl-build/install/include/openssl/pkcs12err.h lib-der_sm2_sig.o (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.