Files
Dragan Spiridonov bbb1676b54 ci: add least-privilege permissions (contents: read) to new workflows
CodeQL/actions best practice + repo convention: invariant-check.yml and
safety-eval.yml lacked an explicit top-level permissions block. Both only
checkout and run scripts/tests — no gh, git push, PR comments, or release
writes — so contents:read is sufficient. Matches existing workflows.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-11 17:02:54 +00:00
..