UI5 / cli / 26511104793

94%

push

github

ci: Harden workflows

- Scope release-please contents/pull-requests write permissions to the
  release-please job; publish jobs only need id-token: write
- Disable persist-credentials on checkouts that don't push to git
- Move repository.name interpolation into env var to avoid template
  injection in run blocks
- Replace spoofable github.actor check in dependabot-auto-merge with
  github.event.pull_request.user.login. Note: spoofing the dependabot
  actor alone is not sufficient to trigger the auto-merge step. The
  dependabot/fetch-metadata action only emits outputs for genuine
  dependabot PRs, so the merge step's check on
  steps.metadata.outputs.update-type would no-op on a spoofed run. The
  change closes the gap defensively.

5099 of 5582 branches covered (91.35%)

Branch coverage included in aggregate %.

9442 of 9823 relevant lines covered (96.12%)

4703.25 hits per line