github-workflows: Security hardening#143

Merged

ganto merged 7 commits into

mainfrom

feature/workflow-hardening

Jul 3, 2026

Commits on Jul 3, 2026

build(deps): bump actions/checkout from 6 to 7

dependabot[bot]
authored and
ganto
committed
build(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0

dependabot[bot]
authored and
ganto
committed
build(deps): bump ko-build/setup-ko from 0.9 to 0.10

dependabot[bot]
authored and
ganto
committed
github-workflows: Use hash instead of tag for GH action release
ganto
committed
github-workflows: Avoid script injection via env vars in e2e status step
ganto
committed
github-workflows: Restrict GITHUB_TOKEN to least-privilege permissions
ganto
committed
github-workflows: Document e2e trigger design and security constraints
ganto
committed