Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/api-validation.yml:
- Around line 21-27: The workflow uses mutable action tags for actions/checkout
and actions/setup-node; update both uses entries to immutable commit SHAs
instead of `@v4`. Keep the existing behavior in the api-validation workflow, but
pin the checkout and Node setup steps to specific SHA references so the workflow
is hardened against tag mutation.
- Around line 1-35: The API validation workflow is using default GITHUB_TOKEN
permissions and leaving checkout credentials persisted, which are unnecessary
for schema validation. Add an explicit least-privilege permissions block for the
workflow/job in api-validation.yml and configure the Checkout repository step to
avoid persisting credentials. Keep the change scoped to the validate job and
preserve the existing validate-api execution with GITHUB_TOKEN only if still
needed.

In `@scripts/validate-api.js`:
- Around line 225-239: fetchGraphQL currently only rejects on HTTP failures, so
GitHub GraphQL responses with a top-level errors array still flow into Zod and
hide the real API error. Update fetchGraphQL to inspect the parsed JSON response
and throw a descriptive error when errors is present before returning data, then
make the callers that validate GraphQLOrgDetailsSchema and the other GraphQL
schemas consume only the data payload after this check.
- Around line 315-439: The live REST validation logic in validate-api.js is
duplicated across the repository, contributors, issues, and rate-limit blocks,
making the flow hard to maintain and easy to drift. Extract the repeated
fetchREST + array check + safeParse + handleZodError + 403 handling into a
shared helper such as validateLiveRESTCollection, then call it from the existing
live REST sections using the specific URL, schema, and label for each resource.
Keep the existing logging behavior and use the same fetchREST, handleZodError,
and schema symbols so the refactor stays localized.
- Around line 210-223: The 403 handling in fetchREST and its downstream catch
blocks is relying on a message substring that never matches, so the
unauthenticated skip path is dead code. Update fetchREST to throw a 403-specific
signal that can be checked reliably, and change the affected catch blocks that
inspect err.message.includes('403') to use a structured status check like
err.status === 403 instead. Make sure the logic around fetchREST and the live
REST skip handling stays consistent so rate-limit/forbidden responses gracefully
skip instead of setting failed = true.
- Around line 25-152: The schemas in validate-api.js are still using deprecated
chained string format methods, especially `.url()`, which will break on a future
Zod major version. Update the affected fields in `OrganizationSchema`,
`RepositorySchema`, `ContributorSchema`, `IssueSchema`,
`GraphQLOrgDetailsSchema`, and `GraphQLRepoIssuesSchema` to use the top-level
`z.url()` form instead of `z.string().url()`. Keep the existing
optional/nullable structure intact while migrating each URL field to the new
API.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/build-matrix.yml:
- Around line 1-31: Harden the build workflow by adding read-only contents
permissions, configuring the Checkout repository step with persist-credentials
disabled, and replacing the checkout and Setup Node.js action tags with
immutable commit SHA references. Preserve the existing workflow triggers,
matrix, and step behavior.