fix(ci): enforce Fern token permission policies

[chet]

The three read-only Fern documentation workflows already limit their GitHub tokens to contents: read, and GitHub applies that restriction at runtime. However, our repository policy check does not yet watch those declarations for drift. This PR enrolls all three workflows in the shared checker so any future permission change requires an explicit policy update and review. Runtime permissions remain unchanged.

The write-scoped preview-comment workflow needs its permissions narrowed to the exact job that writes comments before the shared checker can adopt it, so that authority change stays in a separate follow-up.

Primary callouts are:

• Expected green-run effect: Effectively none. This adds three small shell policy checks to the existing changes job.
• What it really buys us: The read-only Fern documentation workflow family cannot gain new token access without an explicit policy update and review.

What changed

• Added one small policy wrapper for each read-only Fern workflow.
• Registered the existing contents: read contract for each workflow's single job.
• Ran all three checks beside the existing permission-policy checks in Core CI.
• Left the Fern workflows, generic checker, and runtime token permissions unchanged.

Testing

• Shared permission-checker self-test: 60 fixtures passed.
• The existing permission-policy checks and all three new Fern workflow checks passed.
• Bash syntax, ShellCheck 0.11.0, Actionlint 1.7.12, and git diff --check passed.
• cargo make check-format-nightly passed.
• cargo make clippy passed.
• cargo make carbide-lints passed.
• Local CodeRabbit and Claude reviews completed with no in-scope correctness findings remaining.
• Hosted checks passed both final aggregate gates on the exact PR head. Core's first attempt hit a pre-existing database concurrency-test flake; the failed-jobs-only retry passed the same test with 384 tests passed and zero failed, then core-ci-pass succeeded.

Closes #4853

Part of #4572.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 05871f64-8e1d-4e44-9fd7-ee6da8a5ea9c

📥 Commits

Reviewing files that changed from the base of the PR and between 81c1627 and 74b2036.

📒 Files selected for processing (4)

• .github/ci/check-fern-docs-ci-permissions.sh
• .github/ci/check-fern-docs-preview-build-permissions.sh
• .github/ci/check-publish-fern-docs-permissions.sh
• .github/workflows/ci.yaml

---

Summary by CodeRabbit

• Bug Fixes

  • Added automated checks to verify that Fern documentation workflows use the required read-only repository permissions.
  • Integrated permission validation into the core CI process for documentation checks, preview builds, and publishing.

• Chores

  • Added command-line help and workflow path handling for permission checks.

Walkthrough

The pull request adds three Bash wrappers for Fern documentation workflow permission checks. It runs the wrappers in the Core CI changes job. Each wrapper delegates to the shared checker and requires contents=read.

Changes

Fern permission enforcement

Layer / File(s)	Summary
Fern workflow permission wrappers .github/ci/check-fern-docs-ci-permissions.sh, .github/ci/check-fern-docs-preview-build-permissions.sh, .github/ci/check-publish-fern-docs-permissions.sh	The wrappers validate arguments, resolve workflow paths, support help output, and delegate to check-ci-permissions.sh with contents=read.
Core CI integration .github/workflows/ci.yaml	The changes job runs permission checks for the three Fern documentation workflows.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• Enforce Image Scan Token Permissions #4846 — Both changes add workflow-specific wrappers and run them from the CI changes job.

Possibly related PRs

• NVIDIA/infra-controller#4849 — Both changes add CI permission-check wrappers and invoke the shared validator from .github/workflows/ci.yaml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	The description references issues #4853 and #4572, and the changes directly implement the stated linked issue requirements.
Out of Scope Changes check	✅ Passed	The changes are limited to three policy wrappers and CI registration, with runtime workflows and shared checker behavior unchanged.
Title check	✅ Passed	The title clearly identifies the CI change that enforces Fern token permission policies.
Description check	✅ Passed	The description directly explains the policy wrappers, CI integration, unchanged runtime permissions, and validation results.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}