Jordan Ritter 12c535a41b fix(ci): scope app token permissions in eval workflows ...

Add explicit permission-* inputs to actions/create-github-app-token
to satisfy the zizmor github-app rule. Without these, the token
inherits all installation permissions instead of only what's needed.

showcase_eval.yml (post-result job):
  - permission-checks: write  (checks.update)

showcase_eval_check.yml (create-check job):
  - permission-checks: write  (checks.create)
  - permission-issues: write  (issues.listComments/createComment/updateComment)
  - permission-pull-requests: write  (PR comment operations)

2026-05-15 11:55:30 -07:00

24 KiB

Raw Permalink Blame History

View Raw