v1.1.7: fix(ci): use GitHub environment for secrets access
·
75 commits
to master
since this release
f1638bd
This commit was signed with the committer’s verified signature.
The key has expired.
streambinder
Davide Pucci
Replace inline zizmor suppression annotations with a dedicated `secrets` environment (deployment: false). This both fixes the block scalar contamination bug (annotations inside YAML | blocks were baked into -ldflags -X values) and properly scopes secret access to an environment, satisfying secrets-outside-env audits across all zizmor versions.