ci: harden workflow security#1211

Open

emptyhammond wants to merge 7 commits into

mainfrom

worktree-fixup-workflows

Commits on May 22, 2026

ci: pin GitHub Actions to commit SHAs across all workflows
emptyhammond
committed
ci(integration-test): scope GITHUB_TOKEN to contents:read per job
emptyhammond
committed
ci(integration-test): disable credential persistence on checkout
emptyhammond
committed
ci(release): scope publish job permissions to contents:read
emptyhammond
committed
ci(features): pass only the secrets the called workflow actually needs
emptyhammond
committed
ci: disable credential persistence on the remaining checkouts
emptyhammond
committed
ci: scope per-job permissions on the remaining workflows
emptyhammond
committed