Harden template act-validation workflow: add permissions, pin tool versions, verify act checksum

[coderabbitai]

Background

PR #13 hardened the parent .github/workflows/act-validation.yml with:

• permissions: contents: read
• Pinned MARKDOWNLINT_CLI2_VERSION and MBAKE_VERSION environment variables
• SHA-256 checksum verification for the act archive before extraction

The template file template/.github/workflows/act-validation.yml.jinja (rendered into generated projects) still lacks all three protections.

Issues

1. No permissions: declaration — the GITHUB_TOKEN defaults to read/write in generated repositories that have not explicitly restricted it.
2. Unpinned tool versions — markdownlint-cli2 and mbake are not pinned, creating a supply-chain risk for generated projects.
3. No checksum verification — the act archive is piped directly into tar without verifying its SHA-256 digest, allowing a compromised release asset to be executed silently.

Requested changes

• Add a top-level permissions: contents: read block to template/.github/workflows/act-validation.yml.jinja.
• Introduce MARKDOWNLINT_CLI2_VERSION and MBAKE_VERSION env vars at job level and use them in the install step.
• Replace the direct pipe to tar with a download-then-verify-then-extract pattern matching the approach used in .github/workflows/act-validation.yml.

References

• PR: Add generated workflow validation coverage #13
• Raised by: @leynos

[coderabbitai]

🔗 Related PRs

leynos/netsuke#308 - Add Kani smoke CI job (4.1.2) [merged]
leynos/shared-actions#271 - Export the cargo-binstall version pin [merged]
leynos/agent-template-rust#37 - Add generated project agent instructions [merged]
leynos/episodic#127 - Update repository guidance documents [merged]
leynos/ortho-config#335 - Refresh documentation navigation metadata [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!