Alexander Tarasov 6a9642c5b0 ci: Pass the deploy workflow only the secret it uses (#340) ...

The release workflow handed deploy-plugins.yml every repository secret
via `secrets: inherit`, including the release bot's private key, which
that workflow never reads. Declare PLUGIN_DEPLOY_KEY under the called
workflow's `on.workflow_call.secrets` and pass it by name instead, so a
compromise of the deploy path reaches one App key rather than all of
them.

The declaration is optional because deploy-plugins.yml also runs on its
own push and workflow_dispatch triggers, where it reads the repository
secret directly.

Fixes VULN-2697

Claude-Session: https://claude.ai/code/session_01MTuRfuS8BMpYuV8x6jnHFf

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-03 07:28:16 +02:00

..

agents

style: format every markdown file with flowmark (#315)

2026-08-04 17:52:02 -04:00

aw

fix(skill-drift): remove add_reviewer step that fails on scheduled runs (#116)

2026-05-04 21:35:33 +02:00

workflows

ci: Pass the deploy workflow only the secret it uses (#340)

2026-09-03 07:28:16 +02:00

CODEOWNERS

ref(skills): move superseded skills to skills-legacy (#265)

2026-07-10 11:51:09 -04:00

skill-drift-matrix.json

ref(skill-drift): scan references/sdks instead of legacy skills (#266)

2026-07-10 11:39:38 -04:00