MHSanaei 659f0f404c fix(ci): stop executing tag-checkout code in the release smoke test ...

CodeQL alert 99 (actions/cache-poisoning/poisonable-step): the workflow_run
job runs in the default branch's cache scope, so checking out
workflow_run.head_sha and executing a script from it is a cache-poisoning
surface. The if-guard (event == 'push') already kept fork PRs out, but the
checkout pin was never the load-bearing part of the release verification —
the version argument is, since install.sh downloads that exact release
binary. Run the smoke script from the default branch instead, which also
matches what real users execute.

2026-07-07 01:23:10 +02:00

..

ci.yml

chore(ci): bump golangci-lint action to v9

2026-06-27 15:58:36 +02:00

claude-bot.yml

chore(ci): upgrade claude-bot to Sonnet 5 and set explicit effort levels

2026-07-01 00:43:27 +02:00

cleanup_caches.yml

Run cache cleanup daily and reduce cutoff to 1 day

2026-04-21 20:36:28 +02:00

codeql.yml

chore(deps): bump actions/checkout from 6 to 7 (#5454)

2026-06-20 22:25:41 +02:00

docker.yml

chore(deps): bump actions/checkout from 6 to 7 (#5454)

2026-06-20 22:25:41 +02:00

mutation.yml

chore(deps): bump actions/checkout from 6 to 7 (#5454)

2026-06-20 22:25:41 +02:00

release.yml

fix(mtproto): stop dropping connections on client/inbound edits; add live updates + ad-tag (#5838)

2026-07-07 01:13:24 +02:00

smoke.yml

fix(ci): stop executing tag-checkout code in the release smoke test

2026-07-07 01:23:10 +02:00