Garry TanandClaude Fable 5 e2904be7a4 fix(ci): least-privilege permissions + fork-safe concurrency keys ...

- evals.yml / evals-periodic.yml evals jobs: explicit contents:read +
  packages:read (container-image pull) and persist-credentials:false —
  the jobs that execute PR-authored code with three provider API keys
  ran on the repo-default token grant with the token written into
  .git/config
- permissions blocks for the 4 workflows that had none (skill-docs,
  make-pdf-gate, windows-free-tests, windows-setup-e2e)
- fork-safe concurrency keys: actionlint, skill-docs, make-pdf-gate,
  windows-setup-e2e switch from head_ref to PR-number keying — a bare
  branch name carries no fork prefix, so same-name branches from two
  forks shared one group and cancelled each other's runs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-29 04:39:36 +00:00

..

docker

v1.67.0.0 fix: the tracker wave — XProtect self-heal, complete installs, brain-sync integrity, 31 community PRs credited (#2604)

2026-08-16 19:34:41 -07:00

scripts

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

workflows

fix(ci): least-privilege permissions + fork-safe concurrency keys

2026-08-29 04:39:36 +00:00

actionlint.yaml

feat: Wave 3 — community bug fixes & platform support (v0.11.6.0) (#359)

2026-03-23 22:15:23 -07:00

dependabot.yml

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00

PULL_REQUEST_TEMPLATE.md

v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)

2026-08-15 11:42:19 -07:00