Affaan Mustafa daf0355531
ci: harden workflow install boundaries
- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk
2026-05-12 21:55:36 -04:00
..
2026-02-28 10:09:51 -08:00