Garry Tan 7b4b70babd ci: least-privilege tokens on the two lanes that execute PR-controlled code ...

free-tests runs PR code (install lifecycle scripts + the suite) with
whatever the repo-default GITHUB_TOKEN grant is, persisted into
.git/config by checkout. Now: permissions contents:read,
persist-credentials false, pinned by the wiring test. actionlint gets
the same treatment plus a digest pin on the third-party Docker Hub
image (a tag is repointable with no GitHub-side audit trail, and the
image sees the mounted checkout). restore-keys added to both caches so
a lockfile bump warms from the previous cache; stale --parallel header
wording corrected.

2026-08-15 16:49:39 -07:00

..

docker

Merge origin/main (v1.64.1.0 code-smell wave) into test-evals-ci-speedup

2026-08-15 10:29:25 -07:00

scripts

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

workflows

ci: least-privilege tokens on the two lanes that execute PR-controlled code

2026-08-15 16:49:39 -07:00

actionlint.yaml

feat: Wave 3 — community bug fixes & platform support (v0.11.6.0) (#359)

2026-03-23 22:15:23 -07:00

dependabot.yml

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

PULL_REQUEST_TEMPLATE.md

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00