simpleclub / firebase-rules-helper / 22340021183

89%

push

github

chore: set up release-please and update CODEOWNERS (#83)

* chore: set up release-please and update CODEOWNERS

Add release-please workflow, config, and manifest for automated
releases of both firebase-rules-coverage and firebase-rules-generator.
Add auto-approve workflow for release PRs. Update CODEOWNERS from
@IchordeDionysos to @simpleclub/backend-red.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: scope workflow permissions to job level

Move write permissions from workflow level to job level in
release-please.yml and add explicit empty permissions block to
auto-approve.yml to follow the principle of least privilege.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: pin workflow dependencies to full commit SHAs

Pin simpleclub-extended/release-please-action, actions/checkout, and
simpleclub/.github auto-approve workflow to commit SHAs for
supply chain security.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Revert "fix: pin workflow dependencies to full commit SHAs"

This reverts commit 2cdcc5895.

* fix: address PR review comments on workflow configs

Remove unnecessary permissions and use official release-please-action.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: add job-level permissions to auto-approve workflow

Adds minimal `contents: read` permission at the job level to satisfy
CodeQL security scanning while following least-privilege principle.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

32 of 42 branches covered (76.19%)

Branch coverage included in aggregate %.

130 of 140 relevant lines covered (92.86%)

92.34 hits per line