HazyLabandcl-ment 3063593129 ci: harden GitHub Actions permissions, add job timeouts, concurrency and coverage reporting (#951) ...

* ci: harden workflow permissions, add timeouts, concurrency and coverage report

* ci: reuse make fmt-check and refine coverage table formatting

* ci: scan Windows build graph via vulncheck-windows and collapse coverage summary to single-pass awk

* ci: invoke the pinned Windows govulncheck via a local GOBIN

go install writes the binary to GOBIN, which is not necessarily on PATH.
Install into .cache/gobin and run that executable. GOOS=windows applies
only to the scan so the scanner stays a host binary.

* ci: declare contents:read on the action smoke workflow

Pull-request workflows inherit the default GITHUB_TOKEN unless they
set an explicit permission block. The smoke workflow is now covered
by the same least-privilege policy as ci.yml.

* ci: parse workflow permissions structurally and quote the Windows scanner path

The pull-request token check now ignores commented lookalikes and accepts
an inline on: [pull_request] trigger. vulncheck-windows keeps the cache
path as one shell word.

* ci: drop -race from this PR so issue 939 stays with PR 940

Coverage profile remains. The dedicated race-detector job is owned by
the open race PR.

* ci: parse workflow permissions as YAML and scope GOWORK=off

* ci: label the non-race smoke test explicitly

---------

Co-authored-by: cl-ment <[email protected]>

2026-09-12 08:41:14 +08:00

..

install_scripts_test.go

Add local control browser and terminal tools (#319)

2026-06-26 08:22:56 +05:30

workflow_permissions_test.go

ci: harden GitHub Actions permissions, add job timeouts, concurrency and coverage reporting (#951)

2026-09-12 08:41:14 +08:00