Fix documentation lint and build token scope

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

.github/linters/.markdown-lint.yml

@@ -13,6 +13,7 @@ MD007:
   indent: 2                   # Unordered list indentation
 MD013:
   line_length: 808            # Line length
+MD025: false                  # Allow front-matter title + visible H1 on docs pages
 MD026:
   punctuation: ".,;:!。，；:"  # List of not allowed
 MD029: false                  # Ordered list item prefix

.github/workflows/Build-Module.yml

@@ -49,6 +49,7 @@ jobs:
           app-id: ${{ secrets.GitHubAppClientId }}
           private-key: ${{ secrets.GitHubAppPrivateKey }}
           repositories: ${{ github.event.repository.name }}
+          permission-metadata: read
 
       - name: Build module
         uses: ./_wf/.github/actions/Build-PSModule

docs/content/guides/github-app-authentication.md

@@ -41,7 +41,7 @@ Each job mints its own token with the repository that triggered the workflow:
 | Workflow | Requested repository permissions | GitHub operations |
 | --- | --- | --- |
 | Plan | `contents: read`, `pull-requests: write` | Read repository settings and version data, inspect pull-request files and labels, and write planning comments or labels. |
-| Build-Module | No explicit `permission-*` inputs | Read repository metadata while building the module manifest. |
+| Build-Module | `metadata: read` | Read repository metadata while building the module manifest. |
 | Publish-Module | `contents: write`, `pull-requests: write` | Create and upload releases, write pull-request comments, and clean up prereleases. |
 
 The GitHub App installation must grant the permissions requested by each job. Keep the installation and token scope
@@ -68,6 +68,7 @@ The token action is pinned and exposes its output only to the steps that need Gi
     app-id: ${{ secrets.GitHubAppClientId }}
     private-key: ${{ secrets.GitHubAppPrivateKey }}
     repositories: ${{ github.event.repository.name }}
+    permission-metadata: read
 
 - name: Use the token
   env: