mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-17 12:22:34 +03:00
c3e17789bb
The `stage-npm` job adds 2 zizmor findings (192 -> 194), both of the same deliberate @vN convention every workflow in this repo already follows: unpinned-uses on actions/download-artifact@v8 and actions/setup-node@v7, plus the cache-poisoning that setup-node@v7 already raises on the two other jobs in this very file. SHA-pinning only the new job would break the convention. No new class: zero template-injection, artipacked, dangerous-triggers or excessive-permissions. The job declares contents:read + id-token:write, which is the minimum npm provenance needs.