mroberts 5c0a7263e4 Harden the build workflow and grant package write ...

The v1.0.1 tag claimed this work but did not contain it: the edits were still
in the working copy when main was moved and pushed. This is that change.

The run against v1.0.1 reached the registry and failed with 'unauthorized'.
The automatic token cannot write packages without the job asking for it, so
the job now requests packages: write and nothing wider.

actions/checkout is pinned to a commit rather than a tag, at v4.4.0 rather than
the current v7.0.1, which declares node24 that act_runner does not provide.
regctl is pinned to a release instead of tracking latest. Every expansion moves
into env so nothing interpolates into a shell body.

Clean under actionlint and zizmor --persona=auditor. .shush.toml preserves the
comments those linters require, which the comment hook was otherwise removing.

2026-07-31 08:55:19 -05:00

..

build.yml

Harden the build workflow and grant package write

2026-07-31 08:55:19 -05:00