Satoshi Qazi Muhammed 07facbdda2 fix(ci): pass workflow_run head_branch through env; read-only tokens ...

auto-merge.yml interpolated ${{ github.event.workflow_run.head_branch }} straight into a run script that holds a contents:write token. A fork pull request controls that branch name, so it could run commands with write access (CodeQL actions/code-injection/critical). It now arrives as an environment variable.

ci.yml, code-quality.yml and deploy.yml get permissions: contents: read; none of them writes through GITHUB_TOKEN.

2026-10-20 22:07:02 +04:00

..

workflows

fix(ci): pass workflow_run head_branch through env; read-only tokens

2026-10-20 22:07:02 +04:00

dependabot.yml

ci: let Dependabot keep the pinned workflow actions current

2026-10-09 07:02:42 +04:00