* chore(ci): Disable install scripts in release CI and guard security-checks workflow
* fix(ci): complete release install hardening
* test(ci): pin release install step count
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(ci): scope release PAT to push step
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
* fix(ci): export GH_TOKEN so the release-branch push uses CI_BOT_PAT
* fix(ci): export GH_TOKEN so the credential helper sees it at push time
An inline GH_TOKEN prefix only covers the gh auth setup-git call itself;
the helper re-resolves the token when git push invokes it, so the push
would fall back to the job token with persist-credentials disabled.
* fix(test): anchor setup-git ordering check after the export line
A comment in the push step mentions gh auth setup-git before the export,
so indexOf found the comment first and the ordering assertion inverted.
* style(test): wrap long line to satisfy prettier
* fix(ci): address review findings on PAT handling and install comments
- Pin gh auth setup-git before the git push it authenticates in both
release and finalize workflow tests, so moving credential setup after
the push no longer passes.
- Correct the replay comment: npm run generate is not a lifecycle
script and workspace lifecycle scripts stay disabled.
- Drop the overstated push-boundary claim and record why the push
needs the bot PAT rather than the job token.
* test(ci): pin CI_BOT_PAT out of install steps and the publish job header
* style(test): apply prettier's exact re-wrap for the two flagged calls
* test(ci): pin CI_BOT_PAT out of the workflow-level headers too
---------
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
a074d3b042