fix(ci): harden against template injection and credential exposure - #15

Merged

stevebeattie merged 5 commits into

mainfrom

security/psec-923-wolfi-act

May 5, 2026

Commits on May 5, 2026

fix(ci): resolve template injection findings; fix env file for container

stevebeattie
and
claude
committed
f14516d
fix(ci): add persist-credentials: false and scope workflow permissions
stevebeattie
committed
1d49391
fix(ci): add pedantic persona and suppress noisy zizmor rules
stevebeattie
committed
0852f25
fix(ci): quote \$PWD in docker run arguments (SC2086)

stevebeattie
and
claude
committed
91a6dc1
Merge branch 'main' into security/psec-923-wolfi-act
egibs
authored
70ffa08