mirror of https://github.com/garrytan/gstack.git
7b4b70babd
free-tests runs PR code (install lifecycle scripts + the suite) with whatever the repo-default GITHUB_TOKEN grant is, persisted into .git/config by checkout. Now: permissions contents:read, persist-credentials false, pinned by the wiring test. actionlint gets the same treatment plus a digest pin on the third-party Docker Hub image (a tag is repointable with no GitHub-side audit trail, and the image sees the mounted checkout). restore-keys added to both caches so a lockfile bump warms from the previous cache; stale --parallel header wording corrected. |
||
|---|---|---|
| .. | ||
| actionlint.yml | ||
| ci-image.yml | ||
| dependency-review.yml | ||
| evals-periodic.yml | ||
| evals.yml | ||
| free-tests.yml | ||
| make-pdf-gate.yml | ||
| osv-scanner.yml | ||
| pr-title-sync.yml | ||
| quality-gate.yml | ||
| skill-docs.yml | ||
| version-gate.yml | ||
| windows-free-tests.yml | ||
| windows-setup-e2e.yml | ||