ci: remove placeholder API gates and minimize permissions

.github/workflows/ci.yml

@@ -10,8 +10,6 @@ on:
 
 permissions:
   contents: read
-  security-events: write
-  pull-requests: write
 
 jobs:
   build-and-test:
@@ -39,18 +37,12 @@ jobs:
             exit 1
           fi
 
-      - name: Run linter
-        run: npm run lint
+      - name: Run linter without modifying the checkout
+        run: npx eslint "{src,apps,libs,test}/**/*.ts"
 
       - name: Run unit and integration tests
         run: npm run test:cov
 
-      - name: Enforce coverage thresholds
-        run: |
-          # Fails if coverage drops below the required minimum configured in jest
-          # Alternatively we can add a simple script to check the output json.
-          echo "Coverage meets requirements."
-
       - name: Run migration tests
         run: |
           # Simulates a fresh db migration and rollback
@@ -59,6 +51,9 @@ jobs:
 
   security-scans:
     name: Security Scans
+    permissions:
+      contents: read
+      security-events: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

.github/workflows/wave-assignment.yml

@@ -0,0 +1,84 @@
+name: Wave issue assignment
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  assignment:
+    if: github.event.issue.pull_request == null && (github.event.comment.body == '/assign' || github.event.comment.body == '/unassign')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Apply assignment policy
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const issueNumber = context.issue.number;
+            const login = context.payload.comment.user.login;
+            const command = context.payload.comment.body.trim();
+            if (context.payload.comment.user.type === 'Bot') return;
+
+            const { data: issue } = await github.rest.issues.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+            });
+
+            const match = issue.title.match(/^V2-BE-(\d{3})\b/);
+            const taskNumber = match ? Number(match[1]) : 0;
+            const active = issue.labels.some(label => (typeof label === 'string' ? label : label.name) === 'Stellar Wave');
+
+            if (!match || taskNumber < 41 || taskNumber > 90 || !active) {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: issueNumber,
+                body: '@' + login + ' this issue is not an active V2 BE-041–090 Wave task.',
+              });
+              return;
+            }
+
+            if (command === '/unassign') {
+              if (!issue.assignees.some(user => user.login === login)) return;
+              await github.rest.issues.removeAssignees({
+                ...context.repo,
+                issue_number: issueNumber,
+                assignees: [login],
+              });
+              return;
+            }
+
+            if (issue.assignees.length > 0) {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: issueNumber,
+                body: '@' + login + ' this task is already assigned.',
+              });
+              return;
+            }
+
+            const q = 'repo:' + context.repo.owner + '/' + context.repo.repo +
+              ' is:issue is:open label:"Stellar Wave" assignee:' + login;
+            const { data: assigned } = await github.rest.search.issuesAndPullRequests({ q, per_page: 10 });
+            if (assigned.items.some(item => item.number !== issueNumber)) {
+              await github.rest.issues.createComment({
+                ...context.repo,
+                issue_number: issueNumber,
+                body: '@' + login + ' you already hold an active Wave task in this repository. Complete or release it before taking another.',
+              });
+              return;
+            }
+
+            await github.rest.issues.addAssignees({
+              ...context.repo,
+              issue_number: issueNumber,
+              assignees: [login],
+            });
+            await github.rest.issues.createComment({
+              ...context.repo,
+              issue_number: issueNumber,
+              body: '@' + login + ' assigned. Please open a draft PR within seven days, link this issue, and keep the PR limited to this task.',
+            });