Nathan Vasse 768f616859 🔒️(ci) restrict drive-frontend workflow token to contents:read ...

CodeQL flagged the workflow for running with default GITHUB_TOKEN
permissions. None of the jobs need write scopes, so pin to the
minimum to contain blast radius if a third-party action is
compromised.

2026-04-08 17:27:58 +02:00

..

build-mails.yml

♻️(ci) extract build-mails into a reusable workflow

2026-02-06 16:02:25 +01:00

crowdin_download.yml

⬆️(actions) upgrade actions/checkout to v6

2025-12-01 08:39:07 +01:00

crowdin_upload.yml

♻️(backend) migrate from setuptool to uv_build as build backend

2026-01-20 18:53:06 +01:00

docker-hub.yml

⚡️(CI) optimize Docker Hub workflow

2026-02-26 09:19:43 +01:00

drive-frontend.yml

🔒️(ci) restrict drive-frontend workflow token to contents:read

2026-04-08 17:27:58 +02:00

drive.yml

🔧(ci) exclude pdf.worker.mjs from print statement lint

2026-03-30 10:57:09 +02:00

front-dependencies-installation.yml

⬆️(actions) upgrade actions/checkout to v6

2025-12-01 08:39:07 +01:00

helmfile-linter.yaml

♻️(helmfile) rename helmfile

2026-02-06 15:58:20 +01:00

release-helm-chart.yaml

⬆️(actions) upgrade actions/checkout to v6

2025-12-01 08:39:07 +01:00