chore(deps): update schemastore digest to 2d7d28f

[renovate]

This PR contains the following updates:

Package	Update	Change
schemastore (changelog)	digest	ba06047 → 2d7d28f

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

The SchemaStore submodule advances from ba06047 to 2d7d28f. Changes across those commits relevant to ghasec:

• github-workflow.json: Added "code-quality" as a new permission scope value. This is a purely additive enum extension — no existing values were removed or renamed.
• github-action.json: No changes in this commit range.
• Other changed files (claude-code-keybindings.json, pnpm-workspace.json, pyproject.json, catalog.json) are unrelated to ghasec's usage.

No breaking changes, no removals, no structural schema changes.

🎯 Impact Scope Investigation

• Usage pattern: The SchemaStore submodule is exclusively consumed by the code generator (cmd/gen/) to produce rules/invalid-workflow/generated.go and rules/invalid-action/generated.go. The generated files are committed to the repository and compiled directly.
• This PR only updates the submodule pointer — it does not re-run go generate. The committed generated files remain unchanged and will continue to compile and validate correctly.
• Functional gap (non-blocking): After merging, the invalid-workflow rule won't yet recognize code-quality: as a valid permission scope; any workflow using that new permission would receive a false-positive lint error until go generate ./rules/invalid-workflow/ is run and its output committed. This is a known and expected workflow for SchemaStore updates (documented in AGENTS.md).
• checkFilterNegationPatterns in extensions.go has hardcoded event lists per rules/AGENTS.md. The SchemaStore delta doesn't add any new filter-supporting events, so no manual maintenance is required.
• No impact on github-action.json validation, dependencies, or configuration files.

💡 Recommended Actions

• Merge as-is — the submodule pointer update is safe. Build and tests are unaffected.
• Follow-up (optional, non-blocking): Run go generate ./rules/invalid-workflow/ ./rules/invalid-action/ after merging to regenerate generated.go and recognize the new code-quality permission scope. Commit the regenerated file in a separate PR to avoid false-positive errors for users of that new permission.

🔗 Reference Links

• SchemaStore diff ba06047..2d7d28f

Generated by koki-develop/claude-renovate-review