5 Commits

Include renames

Author	SHA1	Message	Date
ekklesiaandClaude Opus 5	51f4075fd6	ci: stop persisting the job token ... `actions/checkout` defaults to `persist-credentials: true`, which writes the job token into `.git/config` and leaves it there for every later step. Nothing in this workflow pushes, so the credential has no use after checkout — but a pull request can edit this file, and any step it adds runs in the same workspace. All three jobs now check out with `persist-credentials: false`. The rest of the workflow's posture is unchanged and was re-verified: top-level `permissions: contents: read`, both actions pinned by full commit SHA, `pnpm install --frozen-lockfile`, no `pull_request_target`, and no secrets referenced anywhere. This is the one property from the Pass 5 runner-isolation requirements that is repository-local and statically verifiable. The rest — whether pull-request jobs run on a disposable guest, what Docker daemon they reach, and which runners this repository can select — depends on the actual Gitea and runner hosts and is not claimed here. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-07-28 19:49:12 -05:00
ekklesia	831a48187c	test: add PostgreSQL migration integration coverage	2026-07-21 09:37:15 -05:00
ekklesia	57552a21a4	feat: add module contracts and discovery	2026-07-12 22:14:01 -05:00
ekklesia	d9489384c1	chore: harden repository guardrails	2026-07-12 21:20:58 -05:00
ekklesia	192a6514cf	chore: establish Ekklesia platform foundation	2026-07-12 20:28:19 -05:00