CodeQL actions/missing-workflow-permissions: lock.yml, pr-any.yml had no permissions block, so their jobs received the repository default token. Read-only where nothing writes through GITHUB_TOKEN; lock-threads gets the issues/pull-requests/discussions write it documents; workflows that write do it with a separate bot or app token, so GITHUB_TOKEN stays read-only.
- continue-on-error is removed; lint, test and build each have to pass,
and fail-fast is off so each reports on its own
- after each step the tree must be unchanged (eslint --fix,
packageInfo.ts written by the build)
- after build, scripts/check-built-manifests.py checks the package.json
npm receives from each build/ directory
- push-main installs with --immutable and checks the manifests too
- the auto-approve and auto-merge bots are removed
SatoshiQaziMuhammed