J3vb 0fab93361c fix: resolve CodeQL code scanning alerts ...

- ci.yml: add top-level `permissions: contents: read` to restrict
  GITHUB_TOKEN to minimum required (fixes 3 missing-workflow-permissions alerts)
- claude-code-review.yml: remove unsafe `ref: pull_request.head.sha`
  checkout in pull_request_target workflow and pin checkout to SHA
  (fixes untrusted-checkout/high alert)
- tenor.ts: add codeql suppression comment for hard-coded-credentials;
  the fallback key is Google's public anonymous demo key, not a secret

2026-04-03 11:47:44 +02:00

..

ci.yml

fix: resolve CodeQL code scanning alerts

2026-04-03 11:47:44 +02:00

claude-code-review.yml

fix: resolve CodeQL code scanning alerts

2026-04-03 11:47:44 +02:00

claude.yml

"Claude PR Assistant workflow"

2026-03-17 02:09:45 +01:00

release.yml

fix: harden server update signing

2026-04-02 23:35:11 +02:00