[pull] trunk from cli:trunk

.github/workflows/codeql.yml

@@ -46,15 +46,6 @@ jobs:
           upload: false
           output: sarif-results
 
-      - name: Filter SARIF for third-party code
-        if: matrix.language == 'go'
-        uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1.0.1.1
-        with:
-          patterns: |
-            -third-party/**
-          input: sarif-results/${{ matrix.language }}.sarif
-          output: sarif-results/${{ matrix.language }}.sarif
-
       - name: Upload filtered SARIF
         uses: github/codeql-action/upload-sarif@v4
         with:

.github/workflows/detect-spam.yml

@@ -4,20 +4,19 @@ on:
     types: [opened]
 
 permissions:
-  contents: none
-  issues: write
-  models: read
+  contents: read # check out the repo to run the spam-detection scripts.
+  issues: write # read issue contents (gh issue view), comment, label, and close issues detected as spam.
+  models: read # run inference via `gh models run` for spam classification.
 
 jobs:
   issue-spam:
     runs-on: ubuntu-latest
-    environment: cli-automation
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Run spam detection
         env:
-          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           ISSUE_URL: ${{ github.event.issue.html_url }}
         run: |
           ./.github/workflows/scripts/spam-detection/process-issue.sh "$ISSUE_URL"

.golangci.yml

@@ -29,8 +29,6 @@ linters:
     # - staticcheck
     # - errcheck
   exclusions:
-    paths:
-      - third-party
     rules:
       - path: _test\.go$
         linters:
@@ -62,9 +60,6 @@ linters:
 formatters:
   enable:
     - gofmt
-  exclusions:
-    paths:
-      - third-party
 
 issues:
   max-issues-per-linter: 0