4 Commits

Author	SHA1	Message	Date
David Barragán Merino	86fc3dd765	👷 Pass explicit secrets to reusable workflows ... Replace secrets: inherit with the secrets each reusable workflow actually uses, and declare them under on.workflow_call.secrets in the called workflow. Declared as required: false so behaviour is unchanged if a secret is missing. Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>	2026-09-30 17:01:58 +02:00
David Barragán Merino	fa3e01f7c7	👷 Disable checkout credential persistence ... Set persist-credentials: false on every actions/checkout step, so the job token is not left in .git/config for the rest of the job. No step after checkout pushes or fetches with it. The only authenticated operation, gh release in release.yml, uses GH_TOKEN. Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>	2026-09-30 17:01:58 +02:00
David Barragán Merino	d1aa07087d	👷 Pin GitHub Actions to commit SHAs ... Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>	2026-09-30 15:29:28 +02:00
David Barragán Merino	f285b2dff7	👷 Add actionlint and zizmor checks for workflows ... Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>	2026-09-30 10:31:02 +02:00