From c8b4b9d84128d5c242e562c4c0c115064ed8cd44 Mon Sep 17 00:00:00 2001
From: Luke Evans <contactluke@gmail.com>
Date: Mon, 4 May 2026 20:57:25 +0100
Subject: [PATCH 1/3] ci: add super-linter (soft launch via shared reusable
 workflow)

---
 .github/linters/.jscpd.json | 13 +++++++++++++
 .github/workflows/lint.yml  | 16 ++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 .github/linters/.jscpd.json
 create mode 100644 .github/workflows/lint.yml

diff --git a/.github/linters/.jscpd.json b/.github/linters/.jscpd.json
new file mode 100644
index 0000000..1d2addf
--- /dev/null
+++ b/.github/linters/.jscpd.json
@@ -0,0 +1,13 @@
+{
+  "threshold": 10,
+  "reporters": ["consoleFull"],
+  "ignore": [
+    "**/node_modules/**",
+    "**/vendor/**",
+    "**/.terraform/**",
+    "**/.venv/**",
+    "**/dist/**",
+    "**/build/**",
+    "**/assets/scss/framework/**"
+  ]
+}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..135c915
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,16 @@
+name: Lint
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  statuses: write
+  pull-requests: write
+
+jobs:
+  lint:
+    uses: LukeEvansTech/shared-workflows/.github/workflows/super-linter.yml@b2f62f289700dca10b92707872be16bf379cf8c1 # v1

From 4606378bd78e7f6f89769a98c3f56335b5ed4c7c Mon Sep 17 00:00:00 2001
From: Luke Evans <contactluke@gmail.com>
Date: Tue, 5 May 2026 21:00:28 +0100
Subject: [PATCH 2/3] fix(jscpd): raise threshold to 30% + ignore test template
 paths

The default 10% threshold catches intentional duplication in test/runbook
templates. Raising to 30% with explicit ignore patterns for tests/.
---
 .github/linters/.jscpd.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/linters/.jscpd.json b/.github/linters/.jscpd.json
index 1d2addf..ee5b8fb 100644
--- a/.github/linters/.jscpd.json
+++ b/.github/linters/.jscpd.json
@@ -1,5 +1,5 @@
 {
-  "threshold": 10,
+  "threshold": 30,
   "reporters": ["consoleFull"],
   "ignore": [
     "**/node_modules/**",
@@ -8,6 +8,8 @@
     "**/.venv/**",
     "**/dist/**",
     "**/build/**",
-    "**/assets/scss/framework/**"
+    "**/assets/scss/framework/**",
+    "**/tests/**",
+    "**/Tests/**"
   ]
 }

From 4b54d7bba567bcd6949790a6994f8c57cf16addf Mon Sep 17 00:00:00 2001
From: Luke Evans <contactluke@gmail.com>
Date: Tue, 5 May 2026 21:48:11 +0100
Subject: [PATCH 3/3] fix(ci): move caller permissions to job level + bump
 shared-workflows SHA

- Top-level permissions reduced to 'contents: read' (least-privilege).
- Job-level adds 'statuses: write' + 'pull-requests: write' for super-linter.
- Bumped LukeEvansTech/shared-workflows pin to current v1 SHA.

Resolves zizmor excessive-permissions on the lint.yml caller.
---
 .github/workflows/lint.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 135c915..683b384 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -8,9 +8,11 @@ on:
 
 permissions:
   contents: read
-  statuses: write
-  pull-requests: write
 
 jobs:
   lint:
-    uses: LukeEvansTech/shared-workflows/.github/workflows/super-linter.yml@b2f62f289700dca10b92707872be16bf379cf8c1 # v1
+    permissions:
+      contents: read
+      statuses: write
+      pull-requests: write
+    uses: LukeEvansTech/shared-workflows/.github/workflows/super-linter.yml@57fff6deea8cdc1b42b62a16e72ce73df3b82f97 # v1