Sanaei a3e617215c fix(ci): pin the head the review job checks out ... The review job checked the pull request out through refs/pull/N/head, a ref the author can move after a maintainer types "@claude review". Code scanning flagged it twice on the issue_comment path: an untrusted checkout in a privileged context (alert 111) and the time-of-check / time-of-use race that ref creates (alert 110). Resolve the head once, up front, and refuse the run when the fork was pushed to after the request that vouched for it, mirroring the freshness gate resolve-conflicts already uses; the checkout then names that immutable SHA. pull_request_target runs take the head SHA straight from the payload, so they skip the comparison. The trailing "posted nothing" check no longer fires on top of a refusal, which would otherwise report a second, misleading failure.		2026-08-22 21:09:24 +02:00
..
ci.yml	Move to TypeScript 7 and the oxc toolchain (oxlint + oxfmt) (#6262)	2026-08-19 15:36:27 +02:00
claude-bot.yml	fix(ci): pin the head the review job checks out	2026-08-22 21:09:24 +02:00
cleanup_caches.yml
codeql.yml
docker.yml	ci: attach provenance and SBOM attestations to the published images (#6130)	2026-08-15 16:59:11 +02:00
docs-ci.yml	Move to TypeScript 7 and the oxc toolchain (oxlint + oxfmt) (#6262)	2026-08-19 15:36:27 +02:00
docs-deploy.yml
mutation.yml
release.yml	ci(release): stamp released binaries with their source revision (#6223)	2026-08-18 11:37:03 +02:00
smoke.yml