AIOSAIandClaude Opus 4.8 dab8d29645 security(ci): add least-privilege permissions block to e2e-wheel workflow ...

e2e-wheel.yml was the only workflow missing a top-level permissions: block
(added during cross-OS work after PR #624 hardened the rest), so it ran with
default broad GITHUB_TOKEN scopes -> OpenSSF Scorecard Token-Permissions = 0.
Add 'permissions: contents: read' to match the other 7 workflows. CHANGELOG
W24 entry.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-08 10:09:00 -07:00

..

ci.yml

ci(seedgo-audit): install memory extra so pyright resolves chromadb/numpy (DPLAN-0195)

2026-06-06 00:32:29 -07:00

e2e-wheel.yml

security(ci): add least-privilege permissions block to e2e-wheel workflow

2026-06-08 10:09:00 -07:00

macos-test.yml

ci: remove path filter from Windows/macOS Test so required checks always run

2026-06-06 05:30:40 -07:00

publish.yml

ci(deps): bump actions/download-artifact from 6.0.0 to 8.0.1

2026-05-30 08:02:57 +00:00

scorecard.yml

ci(deps): bump github/codeql-action from 4.35.3 to 4.36.0

2026-05-30 08:02:55 +00:00

security.yml

ci(security): upgrade pip in dependency-scan, drop stale ignores

2026-06-06 04:54:11 -07:00

stale.yml

ci: harden workflows — least-privilege permissions + SHA-pinned actions

2026-05-29 23:47:27 -07:00

windows-test.yml

ci: remove path filter from Windows/macOS Test so required checks always run

2026-06-06 05:30:40 -07:00