🛡️ chore: Harden CI Supply Chain Workflows (#13090)

* chore: harden CI supply chain workflows

* chore: address CI hardening review feedback

* chore: tighten GitNexus dispatch hardening

* chore: use app token for Locize PR automation

* chore: use dedicated token for Locize PR automation
This commit is contained in:
Danny Avila 2026-05-18 16:55:25 -04:00 committed by GitHub
parent 68eac104ad
commit 21574f02ca
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
22 changed files with 347 additions and 108 deletions

View file

@ -7,14 +7,17 @@ on:
paths:
- 'docs/**'
permissions:
contents: read
jobs:
generate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
- uses: supabase/embeddings-generator@v0.0.5
with:
supabase-url: ${{ secrets.SUPABASE_URL }}
supabase-service-role-key: ${{ secrets.SUPABASE_SERVICE_ROLE_KEY }}
openai-key: ${{ secrets.OPENAI_DOC_EMBEDDINGS_KEY }}
docs-root-path: 'docs'
docs-root-path: 'docs'