Files
Satoshi Qazi Muhammed a9b96a12dc ci: give every workflow an explicit least-privilege GITHUB_TOKEN
CodeQL actions/missing-workflow-permissions: lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
2026-10-20 22:29:14 +04:00
..