ci: GHA workflow security cleanup - #7

Merged

emptyhammond merged 5 commits into

mainfrom

worktree-fixup-workflows

Jun 25, 2026

Commits on May 27, 2026

ci: disable credential persistence on checkout
emptyhammond
committed
2927b91
ci: scope job permissions explicitly
emptyhammond
committed
3c0e536
ci: move workflow context out of run shell source
emptyhammond
committed
cf4f130
ci: pin third-party actions to commit SHAs
emptyhammond
committed
c4eafef
ci: drop venv cache from release workflow
emptyhammond
committed
7e976fa