xavierk 09690e5c77 fix(ci): pass release tag and repo to shell through env ...

Semgrep's run-shell-injection rule flags ${{ github.ref_name }} and
${{ github.repository }} interpolated into run: blocks. The tag name is
attacker-influenced input (git allows $, ( and ; in ref names), so the
release upload steps now read both through step env and quote them.

2026-11-06 19:29:21 +05:30

..

ISSUE_TEMPLATE

feat(identity): rename user-visible identity to voculinux with one-time legacy import

2026-11-06 01:29:39 +05:30

workflows

fix(ci): pass release tag and repo to shell through env

2026-11-06 19:29:21 +05:30

dependabot.yml

chore(release): make a release verifiable, and pin what builds it (epic #701, phase 5) (#759)

2026-08-31 14:32:20 -07:00

FUNDING.yml

Add GitHub Sponsors funding configuration

2026-06-06 19:44:59 -07:00

labeler.yml

feat(identity): rename user-visible identity to voculinux with one-time legacy import

2026-11-06 01:29:39 +05:30

PULL_REQUEST_TEMPLATE.md

docs: improve project documentation for a clearer public surface (#634)

2026-09-07 22:51:14 -07:00