fix: address code review feedback - permissions, separator, release URL versioning

- Add permissions: contents: read to wfctl-strict-contracts CI job (CodeQL fix)
- Replace null byte (\x00) key separator with colon (:) in plugin_test.go
- Add goreleaser hook to auto-update download URLs version on release

Agent-Logs-Url: https://github.com/GoCodeAlone/workflow-plugin-data-engineering/sessions/18d98b1e-7eba-4f0f-8446-bc1fbffb2c53

Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>

Author: Copilot

.github/workflows/ci.yml

@@ -28,6 +28,8 @@ jobs:
 
   wfctl-strict-contracts:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
 

.goreleaser.yml

@@ -4,6 +4,7 @@ before:
   hooks:
     - go mod tidy
     - "sed -i.bak 's/\"version\": \".*\"/\"version\": \"{{ .Version }}\"/' plugin.json && rm -f plugin.json.bak"
+    - "sed -i.bak 's|/releases/download/v[0-9][0-9]*\\.[0-9][0-9]*\\.[0-9][0-9]*/|/releases/download/v{{ .Version }}/|g' plugin.json && rm -f plugin.json.bak"
 
 builds:
   - id: workflow-plugin-data-engineering

internal/plugin_test.go

@@ -657,15 +657,15 @@ func TestPlugin_ModuleContractCoverage(t *testing.T) {
 	// Index contracts by kind+type.
 	byKindType := make(map[string]bool, len(cf.Contracts))
 	for _, d := range cf.Contracts {
-		byKindType[d.Kind+"\x00"+d.Type] = true
+		byKindType[d.Kind+":"+d.Type] = true
 	}
 
 	p := newPlugin(t)
 
 	// Every advertised module type must have a contract entry.
 	missing := []string{}
 	for _, mt := range p.ModuleTypes() {
-		if !byKindType["module\x00"+mt] {
+		if !byKindType["module:"+mt] {
 			missing = append(missing, mt)
 		}
 	}
@@ -677,7 +677,7 @@ func TestPlugin_ModuleContractCoverage(t *testing.T) {
 	// Every advertised trigger type must have a contract entry.
 	missingTrigger := []string{}
 	for _, tt := range p.TriggerTypes() {
-		if !byKindType["trigger\x00"+tt] {
+		if !byKindType["trigger:"+tt] {
 			missingTrigger = append(missingTrigger, tt)
 		}
 	}