mirror of https://github.com/garrytan/gstack.git
7b4b70babd
free-tests runs PR code (install lifecycle scripts + the suite) with whatever the repo-default GITHUB_TOKEN grant is, persisted into .git/config by checkout. Now: permissions contents:read, persist-credentials false, pinned by the wiring test. actionlint gets the same treatment plus a digest pin on the third-party Docker Hub image (a tag is repointable with no GitHub-side audit trail, and the image sees the mounted checkout). restore-keys added to both caches so a lockfile bump warms from the previous cache; stale --parallel header wording corrected. |
||
|---|---|---|
| .. | ||
| docker | ||
| scripts | ||
| workflows | ||
| PULL_REQUEST_TEMPLATE.md | ||
| actionlint.yaml | ||
| dependabot.yml | ||