test(loop): cover tagged permission keys

Author: codeacme17

loops/issue-dev-loop/scripts/lib/validation.mjs

@@ -90,6 +90,7 @@ function conservativeYamlBlock(lines) {
     if (
       !mapping ||
       mapping.quoted ||
+      mapping.key === 'permissions' ||
       /^[{[]/.test(mapping.value) ||
       /^[!&*]/.test(mapping.value)
     ) {
@@ -109,7 +110,8 @@ function historicalWorkflowIsLowPrivilege(source) {
       (line) =>
         line.includes('\t') ||
         /^\s*<<\s*:/.test(line) ||
-        /^\s*[?:]\s/.test(line),
+        /^\s*[?:]\s/.test(line) ||
+        /^(?:---|\.\.\.)\s*(?:#.*)?$/.test(line),
     )
   ) {
     return false

loops/issue-dev-loop/tests/runtime.test.mjs

@@ -5099,6 +5099,18 @@ test('historical active-run targets can validate without newer trusted runtime f
     {permissions: write-all, runs-on: ubuntu-latest, steps: []}
 `,
       ),
+      historicalWorkflow.replace(
+        '    runs-on: ubuntu-latest\n',
+        '    &permission_key permissions: write-all\n    runs-on: ubuntu-latest\n',
+      ),
+      historicalWorkflow.replace(
+        '    runs-on: ubuntu-latest\n',
+        '    !!str permissions: write-all\n    runs-on: ubuntu-latest\n',
+      ),
+      historicalWorkflow.replace(
+        '    runs-on: ubuntu-latest\n',
+        '    - permissions: write-all\n    runs-on: ubuntu-latest\n',
+      ),
     ]
     for (const unsafeWorkflow of unsafeWorkflows) {
       await writeFile(workflowPath, unsafeWorkflow, 'utf8')