Fix CodeQL alerts and add release Makefile (v1.3.1)

- Add permissions: contents: read to CI workflows (missing-workflow-permissions)
- Tighten test assertions to avoid incomplete-url-substring-sanitization pattern
- Bump version to 1.3.1
- Add Makefile with patch/minor/major release targets

Author: kellenmurphy

.github/workflows/dockerhub-readme.yml

@@ -10,6 +10,8 @@ on:
 jobs:
   push-readme:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
 

.github/workflows/test.yml

@@ -7,6 +7,8 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v6
 

Makefile

@@ -0,0 +1,32 @@
+CURRENT_VERSION := $(shell grep -m1 '__version__' py_conf_sync.py | cut -d'"' -f2)
+MAJOR := $(word 1,$(subst ., ,$(CURRENT_VERSION)))
+MINOR := $(word 2,$(subst ., ,$(CURRENT_VERSION)))
+PATCH := $(word 3,$(subst ., ,$(CURRENT_VERSION)))
+
+.DEFAULT_GOAL := help
+
+.PHONY: help patch minor major
+
+help:
+	@echo "Usage: make [patch|minor|major]"
+	@echo "  Current version: $(CURRENT_VERSION)"
+
+patch:
+	$(eval NEW_VERSION := $(MAJOR).$(MINOR).$(shell echo $$(($(PATCH)+1))))
+	$(call _release,$(NEW_VERSION))
+
+minor:
+	$(eval NEW_VERSION := $(MAJOR).$(shell echo $$(($(MINOR)+1))).0)
+	$(call _release,$(NEW_VERSION))
+
+major:
+	$(eval NEW_VERSION := $(shell echo $$(($(MAJOR)+1))).0.0)
+	$(call _release,$(NEW_VERSION))
+
+define _release
+	sed -i 's/__version__ = "$(CURRENT_VERSION)"/__version__ = "$(1)"/' py_conf_sync.py
+	git add py_conf_sync.py
+	git commit -m "chore: bump version to $(1)"
+	git tag v$(1)
+	git push origin main --tags
+endef

py_conf_sync.py

@@ -26,7 +26,7 @@
 from markdownify import markdownify as md
 from dotenv import load_dotenv
 
-__version__ = "1.3.0"
+__version__ = "1.3.1"
 
 # ---------------------------------------------------------------------------
 # Config helpers

tests/test_conversion.py

@@ -683,8 +683,7 @@ def test_relative_link_without_title_uses_page_id_url(self, tmp_path):
         current = tmp_path / "docs" / "containerization.md"
         body = "[Auth Repo](ci/auth.md)"
         result = _resolve_relative_md_links(body, current, config)
-        assert "111222" in result
-        assert "confluence.example.com" in result
+        assert result == "[Auth Repo](https://confluence.example.com/pages/111222)"
 
     def test_relative_link_to_untracked_file_unchanged(self, tmp_path):
         config = self._config(tmp_path, [])
@@ -836,7 +835,7 @@ def test_skips_existing_without_force(self, tmp_path, monkeypatch, capsys):
         cmd_init(args)
         captured = capsys.readouterr()
         assert "skip" in captured.out
-        assert "old.example.com" in config_path.read_text()
+        assert config_path.read_text() == "confluence_url: https://old.example.com\n"
 
     def test_overwrites_with_force(self, tmp_path, monkeypatch):
         monkeypatch.chdir(tmp_path)