fix(workflows): disable lockdown on issue-triage-agent

.github/actionlint.yaml

@@ -0,0 +1,14 @@
+# actionlint configuration
+#
+# Suppress noisy shellcheck findings inside generated agentic workflow lock
+# files (`*.lock.yml` produced by `gh-aw compile`). These files MUST NOT be
+# hand-edited — the next compile will overwrite changes — so we whitelist the
+# specific patterns the codegen emits rather than silencing rules globally.
+#
+# SC2015 ("A && B || C is not if-then-else") fires on the codegen pattern:
+#   [ -f "$f" ] && cp "$f" /dest/ 2>/dev/null || true
+# which is intentional best-effort copy in threat-detection setup steps.
+paths:
+  ".github/workflows/*.lock.yml":
+    ignore:
+      - 'shellcheck reported issue in this script: SC2015'

.github/aw/actions-lock.json

@@ -0,0 +1,9 @@
+{
+  "entries": {
+    "actions/github-script@v9": {
+      "repo": "actions/github-script",
+      "version": "v9",
+      "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
+    }
+  }
+}

.github/workflows/issue-triage-agent.md

@@ -8,8 +8,6 @@ permissions:
   issues: read
 tools:
   github:
-    # For now we are enabling lockdown mode for this workflow since it processes issues from the public repo and we want to ensure it only processes trusted input from maintainers.
-    lockdown: true
     toolsets: [issues, labels]
 safe-outputs:
   add-labels:

README.md

@@ -72,11 +72,15 @@ copilot plugin marketplace add Azure/git-ape
 copilot plugin install git-ape@git-ape
 copilot plugin list   # Should show: git-ape@git-ape
 ```
-```Within Copilot CLI
+
+Within Copilot CLI:
+
+```text
 /plugin marketplace add https://github.com/Azure/git-ape
 /plugin install git-ape@git-ape
 /plugin list   # Should show: git-ape@git-ape
 ```
+
 #### Option C: Local development install
 
 Clone this repository and register the local checkout as a VS Code plugin in `settings.json`: