ci: harden GitHub Actions permissions, add job timeouts, concurrency and coverage reporting - #951

Open

hazyhaar wants to merge 9 commits into

Gitlawb:mainfrom

hazyhaar:ci/harden-workflows-permissions

Commits on Aug 28, 2026

ci: harden workflow permissions, add timeouts, concurrency and coverage report

cl-ment
authored and
hazyhaar
committed
05bc36c
ci: reuse make fmt-check and refine coverage table formatting

cl-ment
authored and
hazyhaar
committed
90cf681
ci: scan Windows build graph via vulncheck-windows and collapse coverage summary to single-pass awk
hazyhaar
committed
cc3602a
ci: invoke the pinned Windows govulncheck via a local GOBIN
hazyhaar
committed
a9ac53c
ci: declare contents:read on the action smoke workflow
hazyhaar
committed
629ae66
ci: parse workflow permissions structurally and quote the Windows scanner path
hazyhaar
committed
309a5f8

Commits on Aug 29, 2026

ci: drop -race from this PR so issue 939 stays with PR 940
hazyhaar
committed
3f18ec2

Commits on Aug 30, 2026

ci: parse workflow permissions as YAML and scope GOWORK=off
hazyhaar
committed
f14fdb4
ci: label the non-race smoke test explicitly
hazyhaar
committed
9c89b03