Neil 08bf209e40 fix(ci): run PR LoC scripts from the default branch, not PR head (#15016) ...

The PR test LoC job fetched .github/scripts/pr-test-loc-*.mjs from
pull/<n>/head and ran them with node while holding a GITHUB_TOKEN scoped
pull-requests: write, so PR-authored code executed under a write token.

Pin the fetch to the repository default branch. base.sha is not enough:
for stacked PRs it is an unreviewed feature-branch commit any collaborator
can push to, while main is gated by branch protection.

Also pass event data via env instead of shell interpolation, and add
set -euo pipefail so a failed download cannot leave a truncated script.

2026-08-16 22:18:50 -07:00

..

actions

fix(release): survive PSGallery outages in the Windows signing preflight

2026-07-30 18:16:38 -07:00

ISSUE_TEMPLATE

chore: ask issue reporters to write in English (#12066)

2026-08-01 23:28:10 -07:00

scripts

ci: render LoC signs Huge bold (#14855)

2026-08-15 23:23:47 -07:00

workflows

fix(ci): run PR LoC scripts from the default branch, not PR head (#15016)

2026-08-16 22:18:50 -07:00

CODEOWNERS

chore: declutter top-level repo layout (#11890)

2026-08-01 00:25:35 -07:00

CONTRIBUTING.md

fix(docs): replace stale preload typecheck reference (#14298)

2026-08-13 13:53:50 -07:00

pull_request_template.md

feat(skills): reland private bundle sharing safely (#14934)

2026-08-16 13:45:54 -07:00