CodeQL actions/missing-workflow-permissions: auto-approve.yml, auto-merge.yml, lock.yml, pr-any.yml, push-master.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
Nothing proposes updates to the workflow actions: several still declare
the Node 20 runtime, which runners already force to Node 24 with a warning
on every run. Dependabot now checks them monthly and groups all action
updates into one pull request.
continue-on-error came with the upstream template: lint, test and build had
been red here since January while every pull request read as passing.
fail-fast: false keeps each step running to the end when another fails.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Satoshi Qazi Muhammed