Oliver Kieselbach 01311898a8 fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 18:21:19 +02:00

..

codeql

fix(security): resolve CodeQL log-forging findings and suppress by-design queries

2026-07-22 01:38:47 +02:00

scripts

fix(ci): upload raw bytes, not a stringified array

2026-08-19 15:31:06 +02:00

workflows

fix(ci): no third-party action holds release/deploy credentials by mutable tag — build-agent creates releases with first-party gh release create (job holds contents/id-token/attestations:write), combine-rules pushes generated outputs with plain git (contents:write on main), deploy-web builds the static export in CI (setup-node 22, npm ci, next build — same path ci.yml tests) and uploads it with the exactly pinned SWA CLI 2.0.10 instead of Azure/static-web-apps-deploy (Oryx in-container build, deploy token as action input), attests portal-<sha>.tar.gz and drops the unusable per-PR preview environments; azure/login and Azure/functions-action are SHA-pinned with version comments for Dependabot

2026-08-30 18:21:19 +02:00

dependabot.yml

chore(dependabot): stop auto-PRing npm major bumps

2026-07-22 01:03:22 +02:00

FUNDING.yml

Update Buy Me a Coffee username in FUNDING.yml

2026-02-24 11:55:17 +01:00