Brennan Benson c4ae923baf fix(ci): vet the adhoc build ref before running it with release secrets (#12161) ... The adhoc workflow checked out any requested ref and ran its scripts and electron-builder config with MAC_CERTS, the notary password, and the adhoc publisher token in reach — including refs/pull/* fork code a maintainer could dispatch in one innocuous-looking click. Vet the ref before checkout: PR refs are refused, branches/tags resolve in a bare tree:0 scratch fetch, raw SHAs must be reachable from a repo branch or tag (a partial clone lazily serves PR-only commits by SHA, so name resolution alone is not a trust test), and checkout pins the vetted SHA so a race push cannot swap the commit. Also reference an adhoc-mac-build environment so the secrets can later be fenced off from stale workflow copies via repo settings.		2026-08-03 18:52:44 -07:00
..
ISSUE_TEMPLATE	chore: ask issue reporters to write in English (#12066)	2026-08-01 23:28:10 -07:00
actions	fix(release): survive PSGallery outages in the Windows signing preflight	2026-07-30 18:16:38 -07:00
scripts	ci: block new root-level entries (#11903)	2026-08-01 01:48:24 -07:00
workflows	fix(ci): vet the adhoc build ref before running it with release secrets (#12161)	2026-08-03 18:52:44 -07:00
CODEOWNERS	chore: declutter top-level repo layout (#11890)	2026-08-01 00:25:35 -07:00
CONTRIBUTING.md	Update CONTRIBUTING.md	2026-06-01 23:38:15 -07:00
pull_request_template.md	…