MHSanaei 659f0f404c fix(ci): stop executing tag-checkout code in the release smoke test ...

CodeQL alert 99 (actions/cache-poisoning/poisonable-step): the workflow_run
job runs in the default branch's cache scope, so checking out
workflow_run.head_sha and executing a script from it is a cache-poisoning
surface. The if-guard (event == 'push') already kept fork PRs out, but the
checkout pin was never the load-bearing part of the release verification —
the version argument is, since install.sh downloads that exact release
binary. Run the smoke script from the default branch instead, which also
matches what real users execute.

2026-07-07 01:23:10 +02:00

..

ISSUE_TEMPLATE

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00

workflows

fix(ci): stop executing tag-checkout code in the release smoke test

2026-07-07 01:23:10 +02:00

dependabot.yml

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

FUNDING.yml

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00

pull_request_template.md

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00