alex cf1ea65414 fix(ci): don't give pull request builds attestation permissions ...

The publish job ran for pull requests with contents: write, id-token:
write, and attestations: write, while running build code from the pull
request. None of these were needed there: uploading artifacts doesn't
need contents: write, and attestation was already skipped for pull
requests. Build with read-only permissions, and attest in a separate
job that only runs on pushes to main.

2026-09-26 20:52:15 -07:00

..

codeql

attempt at codeql config for the right target

2025-10-20 09:08:29 -07:00

ISSUE_TEMPLATE

chore(github): disable blank issues

2025-10-28 16:56:56 -04:00

workflows

fix(ci): don't give pull request builds attestation permissions

2026-09-26 20:52:15 -07:00

CODEOWNERS

add basic github workflows

2025-10-14 23:20:49 -07:00

dependabot.yml

chore(github): rename all files from yaml => yml

2025-10-28 16:47:25 -04:00