Shaun Arman f74238a65a fix(ci): harden CHANGELOG.md API push step per review ... - set -euo pipefail (was -eu; pipefail catches silent pipe failures) - Validate TAG against ^v[0-9]+\.[0-9]+\.[0-9]+$ before use in commit message and JSON payload — prevents shell injection - Tolerate 404 on SHA fetch (new file): curl 2>/dev/null or true keeps CURRENT_SHA empty rather than causing jq to abort - Use jq -n to build JSON payload — conditionally omits sha field when file does not exist yet; eliminates manual string escaping - Check HTTP status of PUT; print response body and exit 1 on non-2xx - Add Accept: application/json header to SHA fetch request		2026-04-12 22:13:25 -05:00
..
auto-tag.yml	fix(ci): harden CHANGELOG.md API push step per review	2026-04-12 22:13:25 -05:00
build-images.yml	fix(ci): replace docker:24-cli with alpine + docker-cli in build-images	2026-04-12 20:16:32 -05:00
pr-review.yml	fix: harden pr-review workflow — secret redaction, log safety, auth header	2026-04-12 18:03:17 -05:00
test.yml	fix(ci): address second AI review — || true, ca-certs, cache@v4, key suffixes	2026-04-12 20:16:32 -05:00