ci(security): least-privilege token permissions (Scorecard)#412

Merged

pallakatos merged 6 commits into

mainfrom

chore/scorecard-token-permissions

Jun 23, 2026

Commits on Jun 23, 2026

ci(security): least-privilege token permissions (Scorecard Token-Permissions)

Pal Lakatos-Toth
and
Copilot
committed
docs(security): osv-scanner ignore config + supply-chain posture doc

Pal Lakatos-Toth
and
Copilot
committed
release: drop ESRP framing, support clean v* tags, stop :latest clobber

Pal Lakatos-Toth
and
Copilot
committed
tools: add cleanup-ghcr-tags.sh to prune non-official package tags

Pal Lakatos-Toth
and
Copilot
committed
fix(e2e): drop spurious --once from local-k8s harness bringup

Pal Lakatos-Toth
and
Copilot
committed
release: short public install (curl|bash), npmjs publish, simpler README

Pal Lakatos-Toth
and
Copilot
committed