30554411913
70%

Ran 30 Jul 2026 02:59PM UTC

Jobs 1

Files 1

Run time 1min

Badge

Embed ▾

Committed 30 Jul 2026 02:58PM UTC coverage: 70.492%. Remained the same

Build # 30554411913

Build Type

push

github

Committed by

web-flow

Commit Message

ci: fix zizmor findings across workflows (#177)

Addresses the 8 alerts zizmor raised after its first scan of main:

- excessive-permissions: add explicit least-privilege permissions
  blocks (go.yml, release.yml, spellcheck.yml), scoped to what each
  job actually needs (contents:read + checks:write for goveralls'
  check-run creation, contents:write for goreleaser's release
  creation, contents:read for the read-only spellcheck job)
- artipacked: set persist-credentials: false on every checkout step
  so the GITHUB_TOKEN isn't left on disk for later steps/artifacts
- cache-poisoning: disable actions/setup-go's default caching in
  release.yml, since it only runs on tag pushes and gains little from
  a cache while being the highest-value target for poisoning

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Coverage Stats

43 of 61 relevant lines covered (70.49%)

6.51 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	30554411913.1	30 Jul 2026 02:59PM UTC	1	70.49	GitHub Action Run

jonasbn / punycode / 30554411913
70%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 30554411913

jonasbn / punycode / 30554411913 70%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 30554411913

jonasbn / punycode / 30554411913
70%

README BADGES
x