Fix code scanning alerts: workflow permissions and polynomial ReDoS

.github/workflows/cd.yml

@@ -8,5 +8,7 @@ on:
 
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      contents: write
     uses: rubyatscale/shared-config/.github/workflows/cd.yml@main
     secrets: inherit

.github/workflows/stale.yml

@@ -5,4 +5,7 @@ on:
     - cron: '0 0 * * *'
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      issues: write
+      pull-requests: write
     uses: rubyatscale/shared-config/.github/workflows/stale.yml@main

.github/workflows/triage.yml

@@ -6,4 +6,6 @@ on:
       - opened
 jobs:
   call-workflow-from-shared-config:
+    permissions:
+      issues: write
     uses: rubyatscale/shared-config/.github/workflows/triage.yml@main

lib/code_teams/utils.rb

@@ -11,7 +11,7 @@ module Utils
     sig { params(string: String).returns(String) }
     def underscore(string)
       string.gsub('::', '/')
-        .gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+        .gsub(/(?<=[A-Z])(?=[A-Z][a-z])/, '_')
         .gsub(/([a-z\d])([A-Z])/, '\1_\2')
         .tr('-', '_')
         .downcase

spec/lib/code_teams/utils_spec.rb

@@ -0,0 +1,31 @@
+RSpec.describe CodeTeams::Utils do
+  describe '.underscore' do
+    # These cases pin the exact behavior of the acronym-splitting step so that the
+    # linear-time zero-width rewrite stays equivalent to the original
+    # `/([A-Z]+)([A-Z][a-z])/` pattern.
+    {
+      '' => '',
+      'A' => 'a',
+      'Ab' => 'ab',
+      'AAb' => 'a_ab',
+      'AABb' => 'aa_bb',
+      'ABCd' => 'ab_cd',
+      'HTMLParser' => 'html_parser',
+      'ALLCAPS' => 'allcaps',
+      'allLower' => 'all_lower',
+      'aABc' => 'a_a_bc',
+      'ABCdEFg' => 'ab_cd_e_fg',
+      'A1b' => 'a1b',
+      'ABC1de' => 'abc1de',
+      'X9Yz' => 'x9_yz',
+      'HTTPResponse2XX' => 'http_response2_xx',
+      'Foo::BarBaz' => 'foo/bar_baz',
+      'Foo::HTMLParser::XMLNode' => 'foo/html_parser/xml_node',
+      'my-Team-Name' => 'my_team_name'
+    }.each do |input, expected|
+      it "converts #{input.inspect} to #{expected.inspect}" do
+        expect(described_class.underscore(input)).to eq(expected)
+      end
+    end
+  end
+end